CVE-2026-86060

Think of SSH as the “front door” for managing your MikroTik router remotely. This bug lets an attacker use a weird, specially crafted username to bypass the router’s normal privilege rules during that login process. If the attacker can reach SSH without already being logged in, they may be able to take over the router and change critical networking settings.

This matters if you run MikroTik RouterOS on a router or gateway used to connect your business to the internet or to manage internal networks. Because the weakness is exploitable during unauthenticated SSH access, your risk is highest when SSH is reachable from the internet (or otherwise reachable from untrusted networks) and exposed to the internet-facing login path. If SSH is not reachable from untrusted networks, your exposure is much lower.

This is RED because CISA added CVE-2026-86060 to the KEV list after confirming real-world exploitation. Attackers are using it to gain elevated control through the SSH login path, so delaying patching materially increases your chance of compromise.

1. Confirm exposure on each RouterOS device

   • Identify whether SSH is enabled.
   • Determine whether the SSH service is reachable from untrusted networks, especially the public internet.
   • Note which network path is exposed (public WAN IP, port-forwarding, firewall rules, or remote-access features).

2. Confirm your exact RouterOS version

   • Record the current RouterOS version for each affected device.

3. Upgrade to a fixed version (target outcome: every device on the fixed releases)

   • RouterOS fixed versions:
     • 7.24.2
     • 7.23.4
     • 6.49.21
   • Use your vendor’s normal upgrade method for RouterOS. Plan for possible brief downtime.

4. If you cannot patch immediately (temporary containment)

   • Remove SSH exposure from the internet:
     • block inbound SSH from all untrusted IP ranges, and
     • allow SSH only from trusted administrative source IPs (or via a VPN/bastion you control), and
     • if possible, disable SSH entirely until after upgrading.

5. Align with CISA KEV expectations

   • CISA remediation due date: 2026-09-13.
   • If you suspect any unauthorized access, follow your incident/triage process and prioritize evidence collection in line with CISA’s “Forensics Triage Requirements” guidance.

6. After upgrading

   • Re-check that SSH is still limited to trusted access paths.
   • Monitor for suspicious login activity or configuration changes (especially changes to admin access or security policy).

CVE-2026-86060 is a RouterOS authentication/login-path weakness (CWE-88) impacting the SSH login handling when usernames begin with a prohibited character. The core mechanism is that the crafted username can alter the trusted RouterOS policy mask, enabling privilege escalation. CISA has added this issue to its Known Exploited Vulnerabilities (KEV) catalog (added 2026-09-10), meaning it is confirmed exploited in the wild; exploitation does not require public exploit code on record. Reported fixed versions are 6.49.21, 7.23.4, and 7.24.2. While EPSS provides a prediction, KEV confirmation is treated as the deciding factor for urgency.