CVE-2026-86060 is a critical vulnerability in MikroTik RouterOS that turns what appears to be an ordinary SSH username into a mechanism for manipulating the privileges assigned to a RouterOS login session.
The vulnerability carries a CVSS 4.0 score of 9.2 and affects the way RouterOS passes SSH login information to its internal /nova/bin/login program. Under vulnerable conditions, a specially constructed username beginning with a normally prohibited character can be interpreted not simply as a username, but as an argument to the login program. This ultimately allows an attacker to influence the trusted RouterOS policy mask used to determine what the resulting session is allowed to do. (CERT Polska)
That would already make CVE-2026-86060 a serious privilege-escalation vulnerability. The real story, however, is considerably worse.
Researchers at CERT Polska have confirmed that CVE-2026-86060 can be chained with CVE-2026-67279 to obtain full unauthenticated access to the RouterOS administrative console. The attack chain, which CERT Polska calls MikroTrick, does not require the attacker to know a valid password, possess the user’s SSH private key, or successfully complete the normal SSH authentication process. (CERT Polska)
The risk is no longer theoretical. CERT Polska observed attacks against internet-accessible MikroTik routers, MikroTik issued emergency RouterOS updates, and CVE-2026-86060 was subsequently added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. CERT Polska reported that successful exploitation had been observed against routers exposing SSH to public networks. (CERT Polska)
For organizations running MikroTik infrastructure, CVE-2026-86060 therefore belongs in a different category from vulnerabilities that are merely severe on paper. This is a critical network-edge vulnerability with confirmed exploitation, a documented path to administrative access, and evidence suggesting exploitation began before full public disclosure.
What Is CVE-2026-86060?
CVE-2026-86060 is officially described as “SSH session privilege manipulation via a crafted username in MikroTik RouterOS.”
The weakness is classified as CWE-88, Improper Neutralization of Argument Delimiters in a Command, commonly described as argument injection. The core problem occurs when RouterOS handles usernames supplied during SSH authentication.
In vulnerable versions of RouterOS, the SSH server eventually passes the username to an internal program called:
/nova/bin/loginCERT Polska reconstructed the normal invocation approximately as:
/nova/bin/login -ssh -trace <trace> -h <client address> [-c <command>] <username> <policy mask>The two important values at the end are the username and the effective RouterOS policy mask.
The policy mask determines the privileges available to the session. Under normal circumstances, RouterOS has already authenticated the user and calculated the appropriate permissions before launching login.
That trust relationship becomes the security boundary.
إن login program does not independently authenticate the account again. It assumes that its parent process has already validated the user and passes trusted values to it. CERT Polska found that the SSH server violated this assumption by forwarding an attacker-controlled username without sufficiently validating how /nova/bin/login would interpret it. (CERT Polska)
This distinction matters.
CVE-2026-86060 is not simply a case where RouterOS accepts a strange username. It is a confused interpretation problem across a process boundary: data considered to be a username by one component can be interpreted as command-line control information by another.
That is why CWE-88 is an appropriate classification.
The Vulnerable RouterOS Versions
CERT Polska’s CVE record identifies the following affected ranges.
| RouterOS branch | Vulnerable versions | Fixed version |
|---|---|---|
| RouterOS 6 | 6.0.0 through versions earlier than 6.49.21 | 6.49.21 |
| RouterOS 7 long-term branch | 7.0.0 through versions earlier than 7.23.4 | 7.23.4 |
| RouterOS 7 stable 7.24 branch | 7.24 through versions earlier than 7.24.2 | 7.24.2 |
| RouterOS beta/testing | Earlier affected builds | 7.25beta3 or later patched build |
MikroTik published its security notice on September 3, 2026 and said that fixes had been included in 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21. The vendor strongly recommended upgrading even though default configurations do not normally expose the vulnerable SSH management interface directly to untrusted networks. (MikroTik)
Administrators should not interpret the phrase “most configurations are not at risk” as evidence that upgrading is optional.
The distinction is exposure.
A MikroTik router whose SSH service is reachable only from a tightly controlled management network has a substantially different attack surface from a router exposing TCP/22 directly to the public internet. But the underlying vulnerable code still exists until RouterOS is updated.
Why CVE-2026-86060 Is More Than a Normal SSH Vulnerability
The unusual part of CVE-2026-86060 becomes clearer when examining how /nova/bin/login parses its arguments.
CERT Polska found that the login program supports a special syntax resembling:
-Nحيث N represents a file descriptor.
When the program encounters that form, it can read login-related information from the selected file descriptor rather than treating the argument as an ordinary username.
The problem is that the RouterOS SSH server previously allowed a username beginning with - to reach this parser.
One username observed during real-world attacks was:
-2This is significant because file descriptor 2 normally represents standard error. In the RouterOS SSH login architecture described by CERT Polska, file descriptors 0, 1, and 2 of the login process refer to the pseudoterminal associated with the SSH session.
Consequently, -2 does not behave like an ordinary account name once /nova/bin/login processes it.
Instead, it triggers the program’s file-descriptor-based input mechanism.
CERT Polska determined that information supplied through that channel can include two NUL-separated values: a username and an effective policy mask. Because the effective policy mask controls RouterOS privileges, an attacker who reaches this point can manipulate the permissions associated with the resulting console. (CERT Polska)
This explains the central security failure:
Attacker-controlled SSH username
↓
RouterOS sshd
↓
Username passed into argv
↓
/nova/bin/login
↓
“-N” interpreted as login option
↓
Attacker influences policy-mask input
↓
Privileged RouterOS sessionThe patched RouterOS builds introduce username validation before the value reaches /nova/bin/login. CERT Polska’s patch analysis specifically found checks rejecting usernames beginning with a hyphen or a space. (CERT Polska)
The Missing Piece: CVE-2026-67279
CVE-2026-86060 alone explains how an attacker can manipulate privileges once the RouterOS login process is reached.
But there is another problem.
Normally, an unauthenticated SSH connection should never be able to reach the point where a privileged session is created.
SSH logically proceeds through multiple stages:
Transport and key exchange
↓
User authentication
↓
SSH_MSG_USERAUTH_SUCCESS
↓
Channel handling
↓
Shell / command executionCERT Polska found another RouterOS SSH bug, CVE-2026-67279, which breaks that state machine.
SSH permits a cryptographic rekey to occur while a connection remains active. A rekey should replace transport keys without accidentally changing the authentication state of the connection.
Vulnerable RouterOS versions handled a rekey performed during user authentication incorrectly.
Instead of returning to the interrupted authentication state when the rekey completed, RouterOS could transition directly into the channel-handling state.
The result was extraordinary: the server could accept a session channel despite never having sent the normal:
SSH_MSG_USERAUTH_SUCCESSmessage.
CVE-2026-67279 by itself did not create an authenticated user or automatically grant administrative permissions. What it did was provide something CVE-2026-86060 desperately needed: a path for an unauthenticated attacker to reach the session creation logic. (CERT Polska)
Combine the two bugs and the architecture collapses.
CVE-2026-86060 and CVE-2026-67279 Form MikroTrick
CERT Polska named the combined attack MikroTrick.
At a high level, the chain works like this:
Internet-exposed RouterOS SSH
↓
Attacker establishes SSH connection
↓
CVE-2026-67279
Authentication state is bypassed
↓
Unauthenticated client obtains session channel
↓
Crafted username reaches /nova/bin/login
↓
CVE-2026-86060
Login argument is misinterpreted
↓
Attacker-controlled policy mask
↓
Full RouterOS administrative consoleCERT Polska’s September 22 technical analysis states explicitly that the two vulnerabilities together allowed attackers to obtain full administrative privileges without knowing a password, possessing an SSH key, or completing authentication. (CERT Polska)
That makes the practical severity easier to understand than the CVSS number alone.
A vulnerable router with internet-accessible SSH potentially exposes its control plane directly to an unauthenticated remote attacker.
Once an attacker gains administrative control over a router, the problem extends far beyond the router itself. A compromised network-edge device can potentially be used to modify routing, establish tunnels, create accounts, alter firewall behavior, intercept or redirect traffic, proxy malicious activity, or establish persistence inside the organization.
An Important Correction: CVE-2026-67276 Is Not MikroTrick
This detail matters because early reporting around the RouterOS incident became confusing.
Some publications associated CVE-2026-67276 with the MikroTrick unauthenticated takeover chain.
According to CERT Polska’s newer September 22 technical analysis, that is incorrect.
CVE-2026-67276 is a separate SSH authentication vulnerability involving incomplete validation of RSA public keys. An attacker who knows the target account name and the public modulus associated with its RSA key can potentially construct another key that RouterOS incorrectly accepts.
Successful exploitation gives the attacker the privileges of that specific account.
MikroTrick is different.
The chain that provides generic unauthenticated administrative access is:
CVE-2026-67279
+
CVE-2026-86060CERT Polska specifically called out the incorrect attribution in its technical report. (CERT Polska)
This distinction is worth preserving in CVE coverage because search results written during the first few days following a vulnerability disclosure often become permanently indexed even after researchers obtain a more complete understanding of the exploit chain.
CVE-2026-86060 Is Being Exploited in the Wild
CVE-2026-86060 should not be treated as a hypothetical research issue.
CERT Polska said it had observed attacks targeting RouterOS systems accessible from the internet and received confirmation that attackers were using the MikroTrick combination to take full control of devices whose SSH service was exposed to public networks. (CERT Polska)
The researchers identified several artifacts associated with the activity.
Observed RouterOS logs included:
login failure for user -2 from <ip> via ssh
user <name> added by ssh:-2@<ip>CERT Polska also reported that attackers created a highly privileged account named:
opsOne IP address associated with confirmed successful attacks was:
82.192.72.4and CERT Polska observed exploitation attempts from:
103.102.31.18The researchers said the successful activity involving the creation of the ops account had been occurring since at least September 2, 2026. (CERT Polska)
These indicators should be useful during incident triage, but they should not be treated as exhaustive signatures.
An attacker who understands the vulnerability can modify account names, infrastructure, persistence techniques and post-exploitation behavior.
The absence of ops, -2, or the two reported IP addresses therefore does not prove a device was never compromised.
CISA Added CVE-2026-86060 to the KEV Catalog
The exploitation evidence was serious enough that CVE-2026-86060 was added to CISA’s Known Exploited Vulnerabilities catalog on September 10, 2026.
CERT Polska reports that CISA gave covered federal organizations a remediation deadline only three days later, on September 13, 2026. (CERT Polska)
That unusually short remediation window illustrates the difference between vulnerability severity and vulnerability risk.
CVSS tells defenders something about the technical impact and exploit characteristics.
KEV status tells them something different: exploitation is known to be occurring outside the laboratory.
For internet-facing RouterOS devices, the latter should heavily influence remediation priority.
MikroTik’s “Flagged” Detection Mechanism
The patched RouterOS releases also contain an interesting compromise-detection feature.
At startup, RouterOS examines its configuration for selected indicators associated with known malicious modifications. When suspicious configuration is detected, RouterOS can disable the relevant configuration entries, generate a critical log message and place the device in a Flagged state.
CERT Polska noted that one new rule specifically looked for an ops account belonging to the highly privileged full group. (CERT Polska)
MikroTik instructs users to inspect the RouterOS log after upgrading. If the device reports that it has been Flagged, administrators should treat the system as potentially compromised and follow MikroTik’s incident-response guidance. (MikroTik)
There is an important limitation, however.
No Flagged status does not mean no compromise.
The mechanism detects selected known artifacts. It cannot prove that attackers did not use another account name, remove traces, use a different persistence technique or modify the device in some way the detection rules do not recognize.
CERT Polska makes this limitation explicit.
For devices that exposed SSH to the public internet while running a vulnerable RouterOS build, incident review should therefore be based on historical exposure and evidence, not solely on the current Flagged state.
How to Detect Possible CVE-2026-86060 Exploitation
Administrators investigating an exposed MikroTik device should start by establishing three facts: what RouterOS version was running, whether SSH was reachable from an untrusted network, and whether the device shows evidence of unauthorized configuration changes.
On RouterOS, the review should include the installed packages and version:
/system package printAdministrators should then review the user database:
/user print detailUnexpected privileged users—especially the known ops indicator—deserve immediate investigation.
Scripts and scheduled tasks should also be reviewed:
/system script print detail
/system scheduler print detailRouterOS logs should be searched for SSH activity involving suspicious usernames, unexpected account creation and Flagged warnings.
CERT Polska specifically recommends checking for unknown users, scripts, scheduler tasks, proxy servers and tunnels following the update. (CERT Polska)
For high-value network infrastructure, defenders should go further and compare the running configuration against a known-good backup. Firewall changes, DNS settings, routing changes, NAT rules, VPN configurations and unfamiliar management-access rules may reveal activity that simple IoC matching misses.
Patching CVE-2026-86060
The most important remediation is straightforward:
upgrade RouterOS.
MikroTik lists the fixes as:
| القناة | Fixed release |
|---|---|
| RouterOS v6 long-term | 6.49.21 |
| RouterOS v7 long-term | 7.23.4 |
| RouterOS v7 stable | 7.24.2 |
| Beta | 7.25beta3 |
Later releases containing the same fixes are also appropriate.
MikroTik additionally recommends that SSH should never be exposed broadly to untrusted networks. The default MikroTik firewall configuration normally prevents management access directly from the internet, but administrators sometimes alter those rules for remote administration.
The vendor recommends restricting SSH to trusted addresses or, preferably, placing router management behind a VPN such as WireGuard rather than exposing management ports publicly. (MikroTik)
This remains good defensive architecture even after CVE-2026-86060 is patched.
Management-plane isolation does not replace vulnerability remediation, but it changes a network-edge zero-day from an internet-scale attack opportunity into a vulnerability that first requires access to the management network.
Why Updating Is Not Enough After Exposure
For organizations whose MikroTik routers had SSH exposed while running a vulnerable version, patching should be considered the start of the investigation rather than the end.
The attack was already being observed before full technical details became widely available.
CERT Polska’s analysis of public logs suggested that exploitation was occurring by at least September 2. MikroTik shipped the emergency updates on September 3, while detailed public CVE information followed shortly afterward. (CERT Polska)
That creates a potential pre-patch compromise window.
A router that was compromised on September 2 does not become trustworthy simply because RouterOS was upgraded on September 5.
The vulnerability disappears.
The attacker’s configuration changes may not.
Organizations with exposed devices should therefore consider credentials, administrative users, VPN secrets and other authentication material potentially accessible from the router during the compromise window.
For especially sensitive environments, rebuilding or resetting the network device from a trusted configuration may provide greater assurance than attempting to remove individual suspicious artifacts from a system that has already been controlled by an attacker.
Why CVE-2026-86060 Is an Interesting Argument-Injection Vulnerability
From a software-security perspective, CVE-2026-86060 is a good example of why “trusted internal data” frequently becomes dangerous when crossing parser boundaries.
The SSH process thinks it is passing:
username = "-2"The receiving program effectively sees something closer to:
option = "-2"The bytes have not changed.
Their meaning has.
This pattern appears throughout vulnerability research. A value validated according to one grammar is later consumed according to another grammar:
HTTP parameter → shell command
filename → command-line argument
username → process argv
JSON string → SQL query
template value → executable expressionSecurity controls frequently fail at precisely this transition.
The defensive lesson is not merely “block -2."
The stronger principle is that data passed between security-sensitive components should either use structured interfaces that preserve types or undergo validation according to the grammar of the final consumer.
MikroTik’s patched versions now validate login parameters before they are handed to /nova/bin/login, including rejecting usernames beginning with characters that could change command-line parsing behavior. (CERT Polska)
MikroTrick Also Shows Why State-Machine Bugs Matter
CVE-2026-67279 provides the other half of the lesson.
SSH is not simply a password prompt wrapped in encryption. It is a protocol with explicit states, transitions, message ordering and nested operations such as rekeying.
Security assumptions depend on those states.
A session channel is safe only if RouterOS can guarantee that the connection reached it through successful authentication.
CVE-2026-67279 broke that guarantee.
CVE-2026-86060 then exploited another guarantee: /nova/bin/login assumed that the username and policy mask supplied by its parent were trustworthy.
The complete chain therefore crosses two independent trust boundaries:
SSH authentication state
↓
CVE-2026-67279
↓
Unauthorized session state
Session input
↓
CVE-2026-86060
↓
Attacker-controlled authorization stateThis is why vulnerability chaining remains so important in real-world penetration testing.
A bug that appears incomplete in isolation can become critical when another vulnerability supplies the missing prerequisite.
Patch Diffing Made the Vulnerability Publicly Discoverable Quickly
There is another unusual part of the CVE-2026-86060 timeline.
MikroTik initially released fixed builds without publishing complete vulnerability details, presumably giving customers time to patch before attackers had a technical roadmap.
That strategy offers only limited secrecy once binaries are publicly downloadable.
Security researchers can compare old and new firmware, identify modified functions and infer what vulnerability the developer was attempting to repair.
Independent researcher Nick Pratley published a detailed analysis of changes between RouterOS releases shortly after the patched binaries appeared. CERT Polska was simultaneously examining the patches and related public reports. (Nick Pratley)
According to CERT Polska, combining patch diffing with suspicious administrator logs enabled researchers to identify CVE-2026-86060 rapidly.
The patched binaries themselves had effectively become a map to the vulnerable code.
That phenomenon is not unique to MikroTik, but AI-assisted reverse engineering is making it increasingly important.
AI-Assisted Vulnerability Research Played a Real Role
The CERT Polska technical report is especially notable because the researchers describe using LLM agents during the RouterOS investigation.
Their laboratory eventually contained 40 RouterOS CHR virtual machines, 39 snapshots and 24 RouterOS releases ranging from 6.43.11 to 7.25beta3. Agents helped operate the virtual machines, perform experiments, extract binaries, use tools such as Ghidra and radare2, compare releases and reason about protocol state transitions. (CERT Polska)
CERT Polska emphasizes that the models did not eliminate the need for conventional vulnerability research.
Researchers still had to construct controlled environments, validate hypotheses, perform negative tests, reproduce results against clean systems and verify impact.
What changed was the speed with which hypotheses could be explored.
That has consequences for vulnerability disclosure.
Once a security update is publicly available, defenders should increasingly assume that both human researchers and AI-assisted systems are diffing the patch immediately.
The period between “patch released” and “exploit understood” is shrinking.
CVE-2026-86060 demonstrates that dynamic particularly well.
CVE-2026-86060 Risk Summary
| السمة | CVE-2026-86060 |
|---|---|
| المنتج | MikroTik RouterOS |
| المكوّن | SSH login path / /nova/bin/login |
| فئة الضعف | Argument injection |
| CWE | CWE-88 |
| CERT Polska CVSS | 9.2 Critical, CVSS 4.0 |
| ناقل الهجوم | Network |
| User interaction | لا يوجد |
| Privileges required | None for the MikroTrick chain |
| Main impact | RouterOS privilege manipulation |
| Exploited in the wild | نعم |
| CISA KEV | نعم |
| Related exploit chain | MikroTrick |
| Chained vulnerability | CVE-2026-67279 |
| Fixed RouterOS versions | 6.49.21, 7.23.4, 7.24.2, 7.25beta3 |
How Security Teams Should Prioritize CVE-2026-86060
The most urgent population consists of MikroTik devices that meet all three conditions:
Vulnerable RouterOS
+
SSH enabled
+
SSH reachable from untrusted networksThose systems should be treated as potential compromise candidates, not merely vulnerable assets.
Devices whose SSH interface was never externally reachable have a significantly lower likelihood of exploitation through the currently documented MikroTrick path, although they should still be patched.
Security teams responsible for larger environments should also avoid limiting discovery to inventory systems. Network infrastructure is frequently managed separately from ordinary endpoint and server inventories, and older routers can remain operational for years.
External attack-surface discovery combined with authenticated configuration inventory provides a better picture of actual exposure.
Frequently Asked Questions About CVE-2026-86060
Is CVE-2026-86060 remotely exploitable?
Yes. The vulnerability affects the RouterOS SSH login path and has a network attack vector. The particularly dangerous scenario is an SSH service exposed to an untrusted network.
Does CVE-2026-86060 require authentication?
The CVE itself concerns privilege manipulation within the login path. When combined with CVE-2026-67279, CERT Polska demonstrated an unauthenticated attack chain in which an attacker can reach the administrative console without successfully completing SSH authentication. (CERT Polska)
What is MikroTrick?
MikroTrick is CERT Polska’s name for the RouterOS exploit chain combining CVE-2026-67279 with CVE-2026-86060. The first vulnerability improperly advances an unauthenticated SSH connection into channel handling; the second lets the attacker manipulate the policy mask passed to RouterOS login.
Is CVE-2026-67276 part of MikroTrick?
According to CERT Polska’s latest technical analysis, no. CVE-2026-67276 is a separate RSA SSH authentication flaw. Some early publications incorrectly associated it with the MikroTrick chain. (CERT Polska)
Has CVE-2026-86060 been exploited?
Yes. CERT Polska confirmed real-world attacks against internet-accessible RouterOS devices, and the vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalog. (CERT Polska)
What RouterOS version fixes CVE-2026-86060?
MikroTik lists 6.49.21, 7.23.4, 7.24.2 and 7.25beta3 as releases containing the relevant security fixes. Administrators should normally install an appropriate current patched release rather than deliberately remaining on the minimum fixed version. (MikroTik)
Does a missing Flagged warning mean my router is safe?
No. Both MikroTik and CERT Polska recommend reviewing the configuration after upgrading. CERT Polska explicitly warns that the Flagged mechanism recognizes selected compromise artifacts and that the absence of the warning does not prove that a device was never compromised. (CERT Polska)
الأفكار النهائية
CVE-2026-86060 is a good example of why the most consequential vulnerabilities are often not spectacular memory-corruption bugs.
The underlying mistake is conceptually simple: a value treated as data by one process becomes control syntax when another process parses it.
In RouterOS, that boundary existed between SSH handling and /nova/bin/login. A crafted username could alter how the login program obtained its authorization information and ultimately manipulate the effective policy mask.
CVE-2026-67279 turned that privilege-manipulation primitive into something far more dangerous by allowing an unauthenticated SSH connection to reach the session-handling stage in the first place.
Together they produced MikroTrick:
Authentication-state bypass
+
Argument injection
+
Authorization manipulation
=
Unauthenticated RouterOS administrative accessAnd unlike many impressive-looking vulnerability chains, this one was not confined to a conference presentation or proof-of-concept repository. Attackers were already using the vulnerabilities against internet-facing MikroTik infrastructure.
For defenders, the response should therefore be equally concrete: patch RouterOS, remove SSH management from untrusted networks, inspect historical exposure, review users and configuration changes, investigate known indicators, and treat previously exposed vulnerable routers as potential incident-response cases rather than assuming that an upgrade retroactively makes the system trustworthy.
The authoritative technical analysis from CERT Polska is particularly worth reading because its September 22, 2026 update provides the clearest current reconstruction of the MikroTrick chain and corrects some of the inaccurate relationships reported during the first days of disclosure. CERT Polska MikroTrick technical analysis
MikroTik’s official security advisory provides the vendor’s patch guidance and recommended management-plane restrictions. MikroTik September 2026 security advisory
CERT Polska’s original active-exploitation warning contains the observed attack indicators and incident-response guidance for affected RouterOS systems. CERT Polska active exploitation advisory
Arabic 
English 
German 
French 
Spanish 
Portuguese 
Japanese 
Korean 
Hindi 
Turkish 
Hebrew