CVE-2026-86060: MikroTik RouterOS SSH Privilege Escalation

Overview

CISA has added CVE-2026-86060, a critical privilege-escalation vulnerability in MikroTik RouterOS, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw sits in RouterOS's SSH login handling and lets an attacker manipulate the device's trusted policy mask through a specially crafted username, ultimately gaining full administrative control without ever authenticating.

The bug is tracked under CWE-88 (Improper Neutralization of Argument Delimiters in a Command) and carries a CVSS score of 9.2. It was identified by Poland's CERT Polska as one of six vulnerabilities disclosed together in RouterOS, two of which can reportedly be chained for complete, unauthenticated device takeover.

Technical Details

How It Works

RouterOS's SSH login helper fails to properly sanitize usernames that begin with a prohibited character. By reaching the login helper with an unauthenticated SSH session and submitting a crafted username, an attacker can alter the router's trusted policy mask — the mechanism RouterOS uses to define what administrative functions a given user or process is permitted to execute. Once that mask is manipulated, the attacker inherits privileges far beyond what an unauthenticated party should ever hold.

Because the flaw is reachable pre-authentication, exploitation requires nothing more than network access to the SSH service — no valid credentials, no user interaction.

A Related Flaw

CISA simultaneously flagged a companion issue, CVE-2026-67277, a missing-authentication vulnerability in RouterOS's bandwidth-test service (btest, CWE-306) that can leak kernel memory and trigger denial-of-service conditions. Devices exposed on both services should be treated as high priority.

Impact Assessment

RouterOS runs on millions of MikroTik routers and access points deployed by ISPs, enterprises, and home-lab operators worldwide. A device compromised via CVE-2026-86060 can be used to:

• Intercept, redirect, or drop network traffic
• Alter firewall and routing policy to enable further intrusion
• Serve as a pivot point into internal networks
• Join large-scale botnets — RouterOS devices have historically been targeted for exactly this purpose

CISA's inclusion of this flaw under Binding Operational Directive 26-04 signals that federal agencies must treat remediation as a forensic-triage event rather than routine patching, reflecting the severity of a fully unauthenticated root-level compromise on edge networking equipment.

Mitigation

Immediate Actions

• Upgrade RouterOS immediately to 6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable), or later
• Disable or restrict SSH exposure — do not expose the SSH management interface to the internet; limit access to trusted management networks or a VPN
• Restrict or disable btest if not actively required, to close the companion CVE-2026-67277 path
• Review router configurations for unauthorized policy or firewall changes following the upgrade

Detection Opportunities

• Audit SSH logs for connection attempts using unusual or malformed usernames
• Look for unexpected changes to user policy masks or administrative accounts
• Monitor for anomalous outbound traffic or new firewall/NAT rules that weren't operator-initiated

Why This Matters

Edge networking gear like MikroTik routers sits at the perimeter of thousands of networks and is frequently internet-facing by design — making pre-auth, full-compromise flaws like this one especially dangerous. Given that CISA has confirmed active exploitation and a tight federal remediation window, organizations running RouterOS should treat this as an emergency patch cycle rather than routine maintenance.

References

• NVD — CVE-2026-86060
• CISA Known Exploited Vulnerabilities Catalog
• MikroTik RouterOS Downloads