Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-86060: MikroTik RouterOS command flaw can give attacker admin rights
CVE-2026-86060 · published 1 month ago · actively exploited
Summary
The RouterOS software on MikroTik devices mishandles special characters in some commands, allowing an attacker to alter the system's trusted policy settings. This can let the attacker gain higher privileges than intended. Update RouterOS to the latest version or apply the vendor's recommended patch to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mikrotik | routeros |
< 7.24.2 >= 6.0, < 6.49.21 >= 7.0, < 7.23.4 >= 7.24, < 7.24.2 |
Original advisory text
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.
References
- https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802 Release Notes
- https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource
- https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-e... Mitigation Third Party Advisory
- https://mikrotik.com/supportsec/september-2026-vulnerability/ Vendor Advisory
- https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-th... Exploit Third Party Advisory
- https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801 Release Notes
- https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800 Release Notes
Internet-facing
3 days
and check for signs of compromise
Internal
3 days
and check for signs of compromise
- Known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
6%
chance of attack within 30 days
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published5 Sep 2026
Updated9 Oct 2026
First seen5 Sep 2026
Track software like this
Free during beta