CVE-2026-86060 is an argument-injection flaw in MikroTik RouterOS's SSH login handling: a username beginning with a disallowed character lets an attacker holding only an unauthenticated SSH session change the router's trusted policy mask and gain full administrative privileges, and CISA's own KEV catalog notes it can be chained with a separate SSH authentication-bypass bug (CVE-2026-67279) for complete unauthenticated takeover — a combination Polish CERT nicknamed "MikroTrick" after observing it exploited in the wild.
Vulnerability summary
| Vulnerability ID | CVE-2026-86060 |
|---|---|
| CVSS score | 9.8 |
| EPSS score | 0.0639 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-09-05T20:17:18.703 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| MikroTik RouterOS | cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:* | 6.0 through 6.49.20 (fixed in 6.49.21 Long-term); 7.0 through 7.23.3 (fixed in 7.23.4 Long-term, later found incomplete and superseded by 7.23.6); 7.24 through 7.24.1 (fixed in 7.24.2 Stable, later found incomplete and superseded by 7.24.3) |
What this means
CVE-2026-86060 is an improper neutralization of argument delimiters in a command (CWE-88) affecting the SSH login path of MikroTik RouterOS. NVD's description states: "RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper" (NVD).
NVD's own analysis assigns a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full impact to confidentiality, integrity and availability; CERT.PL separately scored it CVSS v4.0 9.2 (NVD).
MikroTik's own security advisory (fetched this run) lists CVE-2026-86060 as one of six vulnerabilities disclosed together, describing it as an SSH privilege escalation where "usernames beginning with a disallowed character in the SSH login mechanism" let an attacker "elevate their privileges" to full administrative access, and states fixes shipped in RouterOS 7.24.2 (Stable), 7.23.4 (Long-term) and 6.49.21 (MikroTik Vendor Advisory).
CERT.PL's technical write-up (fetched this run) reports that 7.24.2 and 7.23.4 contained incomplete fixes and that fully patched builds are 7.24.3 (Stable), 7.23.6 (Long-term) and 6.49.21; it also documents in-the-wild exploitation it calls "MikroTrick": attackers chained CVE-2026-86060 with the related SSH authentication-bypass flaw CVE-2026-67279 to take full unauthenticated control of internet-exposed RouterOS devices, creating a privileged account named "ops" originating from IP 82.192.72.4 since at least September 2, 2026 (CERT.PL).
CISA added CVE-2026-86060 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-10, with a required-action due date of 2026-09-13 and forensic-triage flagged "Yes" under CISA's Forensics Triage Requirements; known ransomware-campaign use is listed as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.0639 (93.65th percentile), consistent with confirmed in-the-wild use of this bug as half of an unauthenticated takeover chain (FIRST EPSS).
Because the originally announced patches (7.24.2, 7.23.4) were later found incomplete, any RouterOS device should be upgraded to 7.24.3, 7.23.6 or 6.49.21 or later — not merely to the first round of fixed builds — and SSH management access should be restricted to trusted networks given the documented "ops" account implant activity.
Evidence
- A username beginning with a disallowed character in the RouterOS SSH login path lets an attacker with only an unauthenticated SSH session change the trusted policy mask and escalate privileges. — NVD
- NVD Primary CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; CERT.PL separately scored it CVSS v4.0 9.2. — NVD
- MikroTik's advisory lists the flaw as an SSH privilege escalation via disallowed-character usernames, initially fixed in RouterOS 7.24.2, 7.23.4 and 6.49.21. — MikroTik Vendor Advisory
- 7.24.2 and 7.23.4 fixes were incomplete; fully patched builds are 7.24.3, 7.23.6 and 6.49.21. Attackers chained this bug with CVE-2026-67279 ("MikroTrick") to fully take over internet-exposed routers, creating a privileged "ops" account from IP 82.192.72.4 since September 2, 2026. — CERT.PL
- Added to the CISA KEV catalog on 2026-09-10, due date 2026-09-13, forensic triage required; known ransomware campaign use listed as Unknown. — CISA KEV
- EPSS score is 0.0639 (93.65th percentile) as of 2026-10-29. — FIRST EPSS