- Critical 9.2
- Known exploited (CISA KEV)
CVE-2026-86060
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Scores
The facts
- Published
- 5 September 2026
- Last changed
- 11 September 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 9.2 out of 10 (version 4.0)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R… - Weakness
- Affects
- mikrotik routeros
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 10 September 2026.
- EPSS
- 6.4% chance of exploitation activity in the next 30 days (percentile 94).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.