MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
TL;DR 📌
- MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation.
- Highest CVSS: 9.8 (Critical).
- Listed in CISA KEV (2026-09-10) — this is being exploited in the wild.
- Fixed in
6.49.21,7.23.4,7.24.2— upgrade to this release or later. - CVEs: CVE-2026-86060.
What it is
CVE-2026-86060 is an argument-injection flaw in the SSH login path of MikroTik RouterOS. The vulnerability arises from improper neutralisation of argument delimiters when RouterOS parses usernames at login: a username starting with a prohibited character can be used to alter the trusted RouterOS policy mask, the internal structure that governs what a session is permitted to do.
The access path is unauthenticated: an attacker only needs to reach the SSH login helper on RouterOS, not present valid credentials. By supplying a crafted username at the SSH prompt, the attacker can manipulate the policy mask and escalate privileges on the device.
The CVSS vector (AV:N/AC:L/PR:N/UI:N, with full confidentiality, integrity and availability impact) reflects a network-reachable, low-complexity attack requiring no privileges and no user interaction, with a complete compromise of the affected router as the outcome.
This CVE is listed in the CISA Known Exploited Vulnerabilities catalogue, added 10 September 2026. It is known to be exploited.
What to do
- Upgrade RouterOS to one of the fixed releases: 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable), matching whichever branch you run.
- Until upgraded, restrict SSH access to RouterOS to trusted management networks only — do not expose the SSH service on WAN-facing interfaces.
- Given this is in the CISA KEV catalogue, treat patching as urgent rather than routine maintenance; prioritise internet-facing devices first.
- After patching, review device configuration and user policy masks for unexpected changes, since exploitation directly targets the policy mask that governs permissions.
- Audit logs for SSH login attempts using unusual or malformed usernames, particularly ones beginning with unexpected characters, as a possible indicator of attempted exploitation prior to patching.
For leadership 🧭
Executive summary. Any MikroTik router with SSH reachable can be fully taken over by an attacker who never needs a valid password, simply by sending a malformed username. This is already listed as exploited, so internet-facing routers should be patched or locked down within hours, not weeks.
Why it matters:
- The flaw sits in the SSH login helper itself, so exploitation happens before authentication — no valid credentials, no user interaction, and low attack complexity are required.
- Successful exploitation rewrites the trusted RouterOS policy mask, the internal structure that decides what a session may do, giving the attacker full control over confidentiality, integrity and availability of the device.
- Routers with SSH exposed to the WAN are the most immediate risk; any device reachable from the internet on port 22 (or a custom SSH port) is a direct target.
- This CVE is in the CISA KEV catalogue, meaning it is known to be exploited rather than theoretical.
Now / Next / Later:
- Now: Identify every RouterOS device with SSH reachable from outside the trusted management network and restrict or firewall that access immediately.
- Next: Upgrade all affected devices to the fixed release matching their branch — 6.49.21, 7.23.4, or 7.24.2 — prioritising internet-facing routers first.
- Later: Review SSH login logs for malformed or unexpected usernames as a sign of prior exploitation attempts, and audit user policy masks for unauthorised changes after patching.