CVE-2026-86060 Mikrotik RouterOS
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an…
- CVSS
- 9.2 Critical
- EPSS
- 6.4%
- Percentile
- 94
- Published
- 2026-09-05
- Force
- 10 of 12
- Public PoC
- 3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
On CISA’s exploited list
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
- Added
- 2026-09-10
- Federal patch deadline
- 2026-09-13
- Ransomware use
- not known