RouterOS SSH login privilege escalation, exploited (CVE-2026-86060) [PoC]

Actively exploited in the wild - CVE-2026-86060 is a critical privilege escalation flaw in MikroTik RouterOS that lets an unauthenticated attacker on the network reach the SSH login helper, manipulate a prohibited-character username, and rewrite the trusted policy mask to grant themselves higher privileges. Fixed releases are available in 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable); upgrade immediately.

Overview

RouterOS processes SSH login attempts through a login helper that parses the supplied username before authentication completes. CVE-2026-86060 is an argument-handling flaw in that path: when a username begins with a prohibited character, the parsing logic mishandles the argument boundary, and the trusted RouterOS policy mask attached to the session can be altered.

The policy mask is what defines the privileges a session is allowed to hold. An attacker who can change it can elevate a low-privilege or unauthenticated session into one with administrative reach. Because the flaw is reachable over the network with no credentials, no user interaction and low attack complexity, CISA has added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog. The EPSS score sits at roughly 0.4 percent, indicating broad opportunistic scanning is not yet dominant, but confirmed exploitation means targeted actors are already using it.

Impact

Successful exploitation gives an attacker administrative control of the router without ever authenticating. From there the blast radius is severe: firewall and NAT rule changes, traffic redirection, VPN credential theft, configuration export, and persistent backdoor accounts. RouterOS devices frequently sit at the network edge, so a compromised unit can be used to pivot inward or to silently intercept traffic. Because the policy mask is altered rather than a password being cracked, the intrusion can also leave less obvious authentication trail than a brute-force login.

Remediation

Upgrade to a fixed release on your track:

• RouterOS 6.49.21 (Long-term)
• RouterOS 7.23.4 (Long-term)
• RouterOS 7.24.2 (Stable)

If immediate upgrade is not possible, restrict SSH access to trusted management networks, disable SSH on WAN-facing interfaces, and audit existing user policies for unexpected privilege grants. After patching, rotate credentials and review recent configuration changes and logs for signs of tampering.

Broader context on exploitation trends is available in our security news, and confirmed incident write-ups are collected in our breach reports.

Security Insight

RouterOS has a long history of edge-device vulnerabilities being weaponized quickly, and the appearance of CVE-2026-86060 in the KEV catalog before most administrators had even scheduled a maintenance window repeats that pattern. The notable detail here is the attack surface: a flaw in the login helper, reachable before any credential is presented, reminds defenders that “authentication required” is only a real control if the pre-auth parsing path is trustworthy. Vendors shipping network edge gear should treat argument handling in login code as security-critical, not cosmetic.

Sources

• MikroTik RouterOS security advisories
• CISA Known Exploited Vulnerabilities catalog
• CVE-2026-86060 NVD entry

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs