CVE-2026-86060

What is MikroTik RouterOS?

RouterOS is the operating system that runs on MikroTik's routers, switches, and wireless devices. Its low cost and rich feature set have produced an enormous installed base among internet service providers, small businesses, and home labs worldwide. That ubiquity, combined with the fact that many devices are internet-facing and rarely patched, has made compromised MikroTik devices a favorite building block for botnets, proxy networks, and DDoS infrastructure. Whole botnets (for example Meris and Glupteba proxy nodes) have been built on unpatched RouterOS.

Overview

CVE-2026-86060 is a CVSS 9.8 improper neutralization of argument delimiters (CWE-88) in RouterOS. During SSH login handling, a specially formed username lets an attacker manipulate the trusted RouterOS policy mask and escalate to a fully privileged session. It is the privilege-escalation half of the two-stage chain that CERT Polska named MikroTrick, paired with an SSH authentication bypass to give unauthenticated attackers full administrative control of internet-exposed SSH services. MikroTik shipped fixes on 2026-09-03, and CISA added this CVE to KEV on 2026-09-10.

Affected Versions

MikroTik's bulletin did not publish full vulnerable-version ranges. Any RouterOS release earlier than the fixed build for its train should be treated as affected. The fixes were released 2026-09-03.

Technical Details

RouterOS constructs command-line invocations to helper utilities as part of SSH login processing. A username that begins with a prohibited character is not properly neutralized before it is passed as an argument, so an attacker can inject additional argument delimiters and influence how the login helper runs. The practical effect is that the attacker manipulates the policy mask associated with the SSH session, the bitmask that determines which RouterOS privilege groups the session holds, and promotes the session to full administrative rights.

Attack characteristics:

• Authentication: in the MikroTrick chain, none; this CVE is combined with an SSH authentication bypass (incomplete RSA public-key validation) to reach the vulnerable login path unauthenticated
• Complexity: low
• Vector: network, to an exposed SSH service
• Impact: full administrative takeover (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CERT Polska tracked the chain partner and several related btest and validation bugs in the same six-CVE disclosure, including CVE-2026-67277 (btest kernel memory disclosure and denial of service).

Discovery

CERT Polska (CERT.pl) discovered and coordinated disclosure of the RouterOS vulnerabilities and coined the chain name MikroTrick. The disclosure batch covered six CVEs published on 2026-09-07.

Exploitation Context

CERT Polska confirmed that attackers are actively exploiting the combined chain to take full administrative control of RouterOS devices with SSH exposed to the internet. Exploitation was observed from as early as 2026-09-02, one day before MikroTik's patches. Shadowserver reported roughly 122,500 MikroTik devices with exposed SSH interfaces as of 2026-09-05, though the count of vulnerable or already-compromised devices is undetermined. A distinctive indicator from the campaign is the appearance of an SSH user named -2 (a side effect of the argument-injection technique). Reported attacker IPs include 82.192.72.4 and 103.102.31.18. No public proof of concept and no specific threat-actor attribution had been published as of 2026-09-16.

Remediation

1. Upgrade RouterOS to the fixed build for your train (see table) immediately.
2. Remove SSH from public interfaces. Restrict the SSH service to trusted management IP ranges via firewall rules, or disable it where it is not needed. This closes the exposure the chain depends on.
3. Look for the indicators of compromise. Check the user list for anomalous accounts, especially a user named -2 or other names beginning with unusual characters. Review logs for unexpected SSH logins and for the attacker IPs above.
4. Assume compromise if the device had SSH exposed before patching. Reset the device to a known-good configuration, rotate all credentials, and review scripts, schedulers, SOCKS/proxy settings, and firewall NAT rules for attacker-added persistence.
5. Monitor for reinfection. Devices in this installed base are repeatedly targeted; keep automatic upgrades or a patch cadence in place and continue watching for btest and SSH anomalies.