CVE-2026-86060

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Sep 11, 2026

Description

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
Mikrotik	RouterOS	>= 7.24, < 7.24.2; >= 7.0.0, < 7.23.4; >= 6.0.0, < 6.49.21

References

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cveThird Party Advisory
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/Mitigation, Third Party Advisory
https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802Release Notes
https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801Release Notes
https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800Release Notes
https://mikrotik.com/supportsec/september-2026-vulnerability/Vendor Advisory
https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060US Government Resource

Timeline

Published: Sep 5, 2026
Last modified: Sep 11, 2026
Added to CISA KEV: Sep 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-860626.1LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx re CVE-2026-860637.5Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a CVE-2026-860648.6Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured CVE-2026-860657.5Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/a CVE-2026-860665.9Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ c CVE-2026-86076.4The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Sto CVE-2026-860713.7Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFold CVE-2026-860737.6n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first CVE-2026-860747.1n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential CVE-2026-860757.5n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redir CVE-2026-860768.8n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved throug CVE-2026-860776.5n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed