MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
MikroTik RouterOS SSH login path argument flaw allows unauthenticated privilege escalation. CVSS 9.8 (critical), CISA KEV deadline September 13, 2026.
- Vendor
- MikroTik
- Product
- RouterOS
- CVSS
- 9.8
- EPSS (exploit probability)
- 6.4%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-86060 being exploited?
Yes. CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 6.4% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-86060 timeline
- Added to EU KEV (ENISA)same day as NVD
- Published to NVD
- Added to CISA KEV+5d
- First 0dayNews coverage+8d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
An unauthenticated SSH session to RouterOS’s login helper can trigger privilege escalation. When a username begins with a prohibited character, RouterOS’s argument-handling logic fails to enforce the trusted policy mask correctly, allowing an attacker to change that mask and escalate privileges.
CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10, 2026. Federal agencies must remediate by September 13, 2026. Per the NVD entry, fixes are in RouterOS 6.49.21, 7.23.4 (Long-term), and 7.24.2 (Stable). Update to your channel’s current fixed version.
Other MikroTik RouterOS CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerabilitywrite-up | [ MEDIUM ] | 6.5 | 2.3% | |
| CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerabilitywrite-up | [ HIGH ] | 8.2 | 1.6% | |
| CVE-2018-7445 MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 65.8% | |
| CVE-2018-14847 MikroTik Router OS Directory Traversal Vulnerability | [ CRITICAL ] | 9.1 | 96.0% |
