CVE-2026-86060: MikroTik RouterOS SSH login argument injection privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 4.0 base score is 9.2 (critical), the flaw is remotely reachable without authentication, and CISA KEV lists it with active exploitation and a short remediation deadline.

What it is

RouterOS mishandles arguments in the SSH login path when a username begins with a prohibited character, allowing the trusted policy mask to be altered. This lets an attacker escalate privileges on the router. It is remotely reachable and was fixed in 6.49.21, 7.23.4 and 7.24.2.

Impact

An attacker can change the trusted RouterOS policy mask and gain elevated privileges on the device, potentially taking full control of routing, firewall and management functions.

Attack surface

Reachable over the network via an unauthenticated SSH session to the RouterOS login helper; no user interaction is required. The CVSS vector shows AV:N, PR:N and UI:N, though AT:P indicates a pre-existing condition must be met.

Exploitation

Listed in CISA KEV with a 2026-09-13 remediation due date, and a public third-party write-up tagged Exploit exists. EPSS 30-day probability is about 1.06 percent (62.8th percentile), so mass scanning is not yet indicated.

What to do

• Upgrade to RouterOS 6.49.21, 7.23.4 or 7.24.2 (or later) as the vendor fix.
• If immediate patching is not possible, restrict SSH access to trusted management networks and disable SSH where it is not needed.
• Apply the mitigations in the vendor advisory and CERT Polska guidance, and follow CISA BOD 26-04 triage requirements.
• Audit RouterOS user policies and group masks for unexpected changes after exposure.
• Monitor for exploitation attempts against internet-exposed SSH management interfaces.

Detection

• Review RouterOS logs for SSH login attempts using usernames beginning with unusual or prohibited characters.
• Alert on changes to user groups, policy masks or trusted policy settings outside change windows.
• Hunt for unexpected new or modified RouterOS accounts with elevated privileges.
• Correlate SSH authentication events from external IPs with subsequent configuration changes on the device.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.