Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-86060 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-10 |
| Vendor | MikroTik |
| Product | RouterOS |
| CVSS Score | 9.8 (critical) |
| EPSS Score | 1.1% (percentile: 63%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-13 |
Vulnerability Description
Source: CISA KEV
MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability.
The mechanism belongs to the same family as command injection: input reaches a command without the characters that separate arguments being stripped, so an attacker can append an argument the system never anticipated. Here the consequence is the ability to change the trusted RouterOS policy mask — the structure that governs privilege scope. This leads to privilege escalation.
The device’s role gives the flaw its weight: RouterOS runs on edge routers, at the boundary between the organisation’s network and the internet. Privilege escalation on an edge device means control over routing and traffic filtering rules.
The entry appears in the CISA KEV catalog as actively exploited, and the assigned remediation deadline of 2026-09-13 has passed.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects organisations running MikroTik devices with RouterOS.
RouterOS tends to appear in places that never reach a central asset register: branch offices, remote sites, backup links, and infrastructure inherited through an acquisition. Start the inventory from your list of public addresses rather than from the asset register — the devices nobody remembers are usually the ones running the oldest firmware.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
