Vulnerability Description
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mikrotik | Routeros | >= 6.0, < 6.49.21 |
Related Weaknesses (CWE)
References
- https://cert.pl/en/posts/2026/09/mikrotik-routeros-cveThird Party Advisory
- https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-eMitigationThird Party Advisory
- https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802Release Notes
- https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801Release Notes
- https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800Release Notes
- https://mikrotik.com/supportsec/september-2026-vulnerability/Vendor Advisory
- https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-thExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-US Government Resource
FAQ
What is CVE-2026-86060?
CVE-2026-86060 is a vulnerability with a CVSS score of 9.8 (CRITICAL). RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to pr...
How severe is CVE-2026-86060?
CVE-2026-86060 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-86060?
Check the references section above for vendor advisories and patch information. Affected products include: Mikrotik Routeros.