{"id":"CVE-2026-86060","title":"RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation","summary":"RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requ…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-88"],"vendor":"mikrotik","product":"routeros","affected":["routeros >= 6.0, < 6.49.21","routeros >= 7.0, < 7.23.4","routeros >= 7.24, < 7.24.2"],"patched":["routeros 7.24.2"],"published":"2026-09-05","updated":"2026-09-11","sourceUpdated":"2026-09-11T12:52:16.507","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86060","references":[{"url":"https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve","label":"cvd@cert.pl"},{"url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","label":"cvd@cert.pl"},{"url":"https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802","label":"cvd@cert.pl"},{"url":"https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801","label":"cvd@cert.pl"},{"url":"https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800","label":"cvd@cert.pl"},{"url":"https://mikrotik.com/supportsec/september-2026-vulnerability/","label":"cvd@cert.pl"},{"url":"https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/","label":"cvd@cert.pl"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","in-the-wild","exploit-available","kev"],"exploited":true,"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-10T19:48:03.827888Z"},"scores":{"nvd":9.8,"cna":9.2},"epss":0.01057,"epssPercentile":0.62505,"kev":true,"kevDateAdded":"2026-09-10","kevDueDate":"2026-09-13","kevRansomware":false,"exploits":{"github":1,"githubRepos":["https://github.com/bahirul/cve-2026-86060"],"checkedAt":"2026-09-21T15:31:00.423Z"},"ingestedAt":"2026-09-06T13:55:47.705Z","slug":"CVE-2026-86060","body":"## Overview\n\nRouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)\n\n## Affected\n\n- `routeros >= 6.0, < 6.49.21`\n- `routeros >= 7.0, < 7.23.4`\n- `routeros >= 7.24, < 7.24.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `routeros 7.24.2`","depth":"hadal","depthScore":79,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":25,"ransomware":0},"changes":[{"seq":202060,"id":"CVE-2026-86060","ts":1789400047437,"field":"exploit_available","old":"false","new":"true"},{"seq":202059,"id":"CVE-2026-86060","ts":1789400047437,"field":"exploited","old":"false","new":"true"},{"seq":202058,"id":"CVE-2026-86060","ts":1789400047437,"field":"kev","old":"false","new":"true"},{"seq":202057,"id":"CVE-2026-86060","ts":1789400047437,"field":"cvss","old":"9.2","new":"9.8"},{"seq":200787,"id":"CVE-2026-86060","ts":1789397615731,"field":"exploit_available","old":"true","new":"false"},{"seq":200786,"id":"CVE-2026-86060","ts":1789397615731,"field":"exploited","old":"true","new":"false"},{"seq":200785,"id":"CVE-2026-86060","ts":1789397615731,"field":"kev","old":"true","new":"false"},{"seq":200784,"id":"CVE-2026-86060","ts":1789397615731,"field":"cvss","old":"9.8","new":"9.2"},{"seq":199480,"id":"CVE-2026-86060","ts":1789395519868,"field":"exploit_available","old":"false","new":"true"},{"seq":199479,"id":"CVE-2026-86060","ts":1789395519868,"field":"exploited","old":"false","new":"true"},{"seq":199478,"id":"CVE-2026-86060","ts":1789395519868,"field":"kev","old":"false","new":"true"},{"seq":199477,"id":"CVE-2026-86060","ts":1789395519868,"field":"cvss","old":"9.2","new":"9.8"},{"seq":198725,"id":"CVE-2026-86060","ts":1789392243329,"field":"exploit_available","old":"true","new":"false"},{"seq":198724,"id":"CVE-2026-86060","ts":1789392243329,"field":"exploited","old":"true","new":"false"},{"seq":198723,"id":"CVE-2026-86060","ts":1789392243329,"field":"kev","old":"true","new":"false"},{"seq":198722,"id":"CVE-2026-86060","ts":1789392243329,"field":"cvss","old":"9.8","new":"9.2"},{"seq":197058,"id":"CVE-2026-86060","ts":1789384291746,"field":"exploit_available","old":"false","new":"true"},{"seq":197057,"id":"CVE-2026-86060","ts":1789384291746,"field":"exploited","old":"false","new":"true"},{"seq":197056,"id":"CVE-2026-86060","ts":1789384291746,"field":"kev","old":"false","new":"true"},{"seq":197055,"id":"CVE-2026-86060","ts":1789384291746,"field":"cvss","old":"9.2","new":"9.8"},{"seq":194187,"id":"CVE-2026-86060","ts":1789378782397,"field":"exploit_available","old":"true","new":"false"},{"seq":194186,"id":"CVE-2026-86060","ts":1789378782397,"field":"exploited","old":"true","new":"false"},{"seq":194185,"id":"CVE-2026-86060","ts":1789378782397,"field":"kev","old":"true","new":"false"},{"seq":194184,"id":"CVE-2026-86060","ts":1789378782397,"field":"cvss","old":"9.8","new":"9.2"},{"seq":192974,"id":"CVE-2026-86060","ts":1789376514378,"field":"exploit_available","old":"false","new":"true"},{"seq":192973,"id":"CVE-2026-86060","ts":1789376514378,"field":"exploited","old":"false","new":"true"},{"seq":192972,"id":"CVE-2026-86060","ts":1789376514378,"field":"kev","old":"false","new":"true"},{"seq":192971,"id":"CVE-2026-86060","ts":1789376514378,"field":"cvss","old":"9.2","new":"9.8"},{"seq":191761,"id":"CVE-2026-86060","ts":1789373630411,"field":"exploit_available","old":"true","new":"false"},{"seq":191760,"id":"CVE-2026-86060","ts":1789373630411,"field":"exploited","old":"true","new":"false"},{"seq":191759,"id":"CVE-2026-86060","ts":1789373630411,"field":"kev","old":"true","new":"false"},{"seq":191758,"id":"CVE-2026-86060","ts":1789373630411,"field":"cvss","old":"9.8","new":"9.2"},{"seq":190546,"id":"CVE-2026-86060","ts":1789369474628,"field":"exploit_available","old":"false","new":"true"},{"seq":190545,"id":"CVE-2026-86060","ts":1789369474628,"field":"exploited","old":"false","new":"true"},{"seq":190544,"id":"CVE-2026-86060","ts":1789369474628,"field":"kev","old":"false","new":"true"},{"seq":190543,"id":"CVE-2026-86060","ts":1789369474628,"field":"cvss","old":"9.2","new":"9.8"},{"seq":189333,"id":"CVE-2026-86060","ts":1789368408319,"field":"exploit_available","old":"true","new":"false"},{"seq":189332,"id":"CVE-2026-86060","ts":1789368408319,"field":"exploited","old":"true","new":"false"},{"seq":189331,"id":"CVE-2026-86060","ts":1789368408319,"field":"kev","old":"true","new":"false"},{"seq":189330,"id":"CVE-2026-86060","ts":1789368408319,"field":"cvss","old":"9.8","new":"9.2"},{"seq":188116,"id":"CVE-2026-86060","ts":1789365230037,"field":"exploit_available","old":"false","new":"true"},{"seq":188115,"id":"CVE-2026-86060","ts":1789365230037,"field":"exploited","old":"false","new":"true"},{"seq":188114,"id":"CVE-2026-86060","ts":1789365230037,"field":"kev","old":"false","new":"true"},{"seq":188113,"id":"CVE-2026-86060","ts":1789365230037,"field":"cvss","old":"9.2","new":"9.8"},{"seq":186903,"id":"CVE-2026-86060","ts":1789363470604,"field":"exploit_available","old":"true","new":"false"},{"seq":186902,"id":"CVE-2026-86060","ts":1789363470604,"field":"exploited","old":"true","new":"false"},{"seq":186901,"id":"CVE-2026-86060","ts":1789363470604,"field":"kev","old":"true","new":"false"},{"seq":186900,"id":"CVE-2026-86060","ts":1789363470604,"field":"cvss","old":"9.8","new":"9.2"},{"seq":185689,"id":"CVE-2026-86060","ts":1789361228374,"field":"exploit_available","old":"false","new":"true"},{"seq":185688,"id":"CVE-2026-86060","ts":1789361228374,"field":"exploited","old":"false","new":"true"}]}