CVE-2026-86060: MikroTik RouterOS Privilege Escalation

CVE-2026-86060 Overview

CVE-2026-86060 is an argument-handling flaw in the MikroTik RouterOS SSH login path. Usernames beginning with a prohibited character alter the trusted RouterOS policy mask, escalating an unauthenticated session to full administrative privileges. The weakness maps to CWE-88: Improper Neutralization of Argument Delimiters in a Command. Exploitation only requires network reachability to the SSH service and does not require valid credentials. CISA has added CVE-2026-86060 to the Known Exploited Vulnerabilities catalog, and CERT Poland has confirmed active exploitation. MikroTik shipped fixes in RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

Critical Impact
Unauthenticated attackers reachable over SSH can obtain full-policy administrative control of affected RouterOS devices, enabling traffic interception, configuration tampering, and persistent network compromise.

Affected Products

MikroTik RouterOS 6.x prior to 6.49.21 (Long-term)
MikroTik RouterOS 7.x prior to 7.23.4 (Long-term)
MikroTik RouterOS 7.24.x prior to 7.24.2 (Stable)

Discovery Timeline

2026-09-05 - CVE-2026-86060 published to the National Vulnerability Database
2026-09-11 - Last updated in the NVD database
September 2026 - MikroTik publishes the September 2026 Vulnerability Report and releases fixed builds
September 2026 - CERT Poland issues an active exploitation warning
September 2026 - CISA lists CVE-2026-86060 in the Known Exploited Vulnerabilities catalog

Technical Details for CVE-2026-86060

Vulnerability Analysis

RouterOS mishandles argument parsing inside the SSH login helper. When a username begins with a specific prohibited character, downstream logic reinterprets the value as an option flag rather than an identifier. This causes the trusted policy mask assigned to the session to be replaced with a broader set of privileges. The result is a pre-authentication privilege escalation reachable over the network. Third-party reverse engineering of the fix, published in the NPratley analysis, confirms the patch tightens username validation before the policy mask is computed. Successful exploitation grants control of routing, firewalling, VPN termination, and packet capture on the compromised device.

Root Cause

The root cause is an argument injection weakness in the SSH login path. RouterOS treats the leading character of the username as syntactically significant rather than as opaque user input. Because the policy mask is derived from parsed arguments, a crafted username coerces the helper into assigning trusted RouterOS policies to an untrusted session. The flaw is a classic [CWE-88] failure to neutralize argument delimiters between parsing stages.

Attack Vector

The attack vector is remote and unauthenticated. An adversary opens a TCP session to the RouterOS SSH service and submits a username beginning with the prohibited character. The malformed username reaches the login helper, alters the session policy mask, and grants administrative access without any valid credential. No user interaction is required, and no prior foothold on the network is needed. CERT Poland reports opportunistic scanning and exploitation of internet-exposed RouterOS devices.

No verified public exploit code is available. Refer to the MikroTik security advisory and the NPratley patch analysis for the technical mechanism.

Detection Methods for CVE-2026-86060

Indicators of Compromise

SSH authentication events on RouterOS with usernames containing leading non-alphanumeric or option-style characters such as - or --.
Unexpected changes to the RouterOS user database, group policies, or SSH keys following an inbound SSH connection.
New administrative sessions in the RouterOS logs originating from external or unfamiliar source IP addresses.
Outbound connections from the router to unknown infrastructure, or unexpected changes to firewall, NAT, or routing rules.

Detection Strategies

Alert on RouterOS system,info,account log entries showing successful logins that immediately follow malformed username attempts.
Inspect SSH server telemetry for authentication attempts where the submitted username begins with characters normally rejected by RouterOS.
Correlate SSH login success events with subsequent configuration exports, script installations, or scheduler additions on the same device.

Monitoring Recommendations

Forward RouterOS syslog to a centralized platform and retain SSH authentication, configuration change, and user management events.
Baseline administrative session sources and alert on first-seen source IPs authenticating over SSH.
Monitor for the presence of patched firmware versions 6.49.21, 7.23.4, or 7.24.2 across the fleet and flag devices still on vulnerable builds.

How to Mitigate CVE-2026-86060

Immediate Actions Required

Upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable) as documented in the MikroTik September 2026 advisory.
Restrict SSH access to management networks using the RouterOS firewall and disable SSH exposure on WAN interfaces.
Rotate all RouterOS credentials, SSH keys, and API tokens after patching, since active exploitation has been confirmed.
Audit device configuration, users, scheduler entries, and scripts for unauthorized changes following the patching window.

Patch Information

MikroTik has released fixed firmware in RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable). Release details are published in the MikroTik forum announcements for 6.49.21, 7.23.4, and 7.24.2. Patching is the only supported remediation.

Workarounds

Disable the RouterOS SSH service entirely on devices that cannot be patched immediately.
Bind SSH to a management VLAN or VPN-only interface and block TCP/22 at the perimeter for all other sources.
Apply an ip service address allowlist restricting SSH to known administrator source addresses.

bash

# Configuration example: restrict SSH to a management subnet on RouterOS
/ip service set ssh address=192.0.2.0/24
/ip firewall filter add chain=input protocol=tcp dst-port=22 src-address=!192.0.2.0/24 action=drop comment="Block SSH from non-mgmt"
# After patching, verify version
/system resource print