CVE-2026-86060
Last modified
CVE-2026-86060 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable). CISA has confirmed active exploitation in the wild. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mikrotik | Routeros | >= 6.0, < 6.49.21 |
| Mikrotik | Routeros | >= 7.0, < 7.23.4 |
| Mikrotik | Routeros | >= 7.24, < 7.24.2 |
References
- https://cert.pl/en/posts/2026/09/mikrotik-routeros-cveThird Party Advisory
- https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/Mitigation, Third Party Advisory
- https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/Exploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-86060?
How severe is CVE-2026-86060?
How do I fix CVE-2026-86060?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-86049Jupyter Server is the backend for Jupyter web applications. …7.1
- CVE-2026-8605In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vu…9.8
- CVE-2026-86054Notepad++ is a free and open-source source code editor. Prio…7.8
- CVE-2026-86056Notepad++ is a free and open-source source code editor. Prio…5.5
- CVE-2026-86059Dokploy is a free, self-hostable Platform as a Service (PaaS…9.6
- CVE-2026-8606A Server-Side Request Forgery (SSRF) vulnerability was ident…5.9
- CVE-2026-86062LightRAG provides simple and fast retrieval-augmented genera…6.1
- CVE-2026-86063Claude Code is an agentic coding tool. Prior to 2.1.179, the…7.5
- CVE-2026-86064Klever-Go is the Go implementation of the Klever blockchain …8.6
- CVE-2026-86065Klever-Go is the Go implementation of the Klever blockchain …7.5
- CVE-2026-86066Horilla is an HR and CRM software. Prior to 2.0.0, approve_v…5.9
- CVE-2026-8607The Points Management System For Gamification, Ranks, Badges…6.4
Are you affected by CVE-2026-86060?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST