CVE-2026-86060: listed in the CISA KEV catalog

CVE-2026-86060 · EPSS 1% · KEV 2026-09-10 · patch available

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Is CVE-2026-86060 exploited?

• Listed in the CISA KEV catalog on 2026-09-10.
• Federal remediation due 2026-09-13.
• Past that date by 9 days.
• EPSS puts exploitation in the next 30 days at 1%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• MikroTik · RouterOS · <7.23.4
• MikroTik · RouterOS · <6.49.21
• MikroTik · RouterOS · <7.25 beta 3
• MikroTik · RouterOS · <7.24.2
• Mikrotik · RouterOS · >= 7.24, < 7.24.2, >= 7.0.0, < 7.23.4, >= 6.0.0, < 6.49.21

Is there a patch?

• RouterOS 7.23.4
• RouterOS 6.49.21
• RouterOS 7.25 beta 3
• RouterOS 7.24.2

What PlainSec published about CVE-2026-86060

• MikroTik RouterOS Chain Enabled Unauthenticated Takeover (2026-09-22)

Primary sources

• NVD record
• CISA KEV catalog

What this record does not say

• No CVSS score from NVD.

KEV and EPSS are re-checked daily. Record last updated 2026-09-22.