CVE-2026-86060: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation.
Overview
MikroTik RouterOS contains an argument injection flaw in its SSH login handler that allows an unauthenticated attacker to obtain a session with full administrative privileges. The flaw affects RouterOS versions in the 6.x line before 6.49.21 and the 7.x line before 7.23.4 (long-term) or 7.24.2 (stable). CERT Polska has confirmed active exploitation in the wild, where attackers are combining this flaw with a companion SSH authentication bypass to take complete control of internet-exposed devices without any credentials.
Vulnerability details
The SSH login handler in RouterOS fails to reject usernames that begin with a prohibited character such as a hyphen. Under CWE-88, argument injection occurs when user-supplied input is passed to a command or transport layer without stripping delimiter characters, causing the input to be interpreted as a flag or argument rather than a literal data value. In this case, a username beginning with a hyphen reaches a legacy file-descriptor login transport, which interprets the value as a file descriptor specifier rather than a username string. The result is that the session is assigned the full RouterOS policy mask instead of the restricted one that would normally apply.
An attacker who can reach the RouterOS SSH service sends a crafted login attempt using a username such as '-2'. No valid credentials are required to trigger the flaw; the malformed username alone causes the login transport to apply a full administrative policy mask to the resulting session. With that session, the attacker has complete control: adding users, modifying configuration, executing arbitrary RouterOS commands, and persisting access. CERT Polska observed attackers using this path to create a highly privileged account named 'ops'. The precondition is that the SSH port must be reachable; MikroTik's default configuration blocks SSH from the internet, but many operators open it manually.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review RouterOS logs for the specific entries 'login failure for user -2 from <ip> via ssh' or 'user <name> added by ssh:-2@<ip>' — both are confirmed indicators of exploitation attempts documented by CERT Polska.
- Check for the presence of an unexpected user named 'ops' or any other unrecognized account with elevated privileges, and inspect scheduler tasks, scripts, proxy settings, and tunnels for unauthorized additions.
- After upgrading, run '/system/device-mode/print' and check the RouterOS log for a critical 'Flagged' entry, which the fixed releases write when they detect known post-compromise configuration changes at startup.
Remediation
Additional hardening
- Upgrade RouterOS to 6.49.21 (long-term v6), 7.23.4 (long-term v7), or 7.24.2 (stable); these are the first releases containing the fix for all maintained branches.
- Restrict SSH access to explicitly trusted source IP addresses using RouterOS firewall input-chain rules, or disable SSH entirely and require management access only over a WireGuard VPN tunnel.
- If a device shows the 'Flagged' marker or the exploitation log entries, treat it as fully compromised: capture a supout file, reset to factory defaults, restore configuration from a known-good backup taken before the exposure window, and rotate all credentials.
- Audit firewall input rules to confirm that SSH (TCP 22) is not reachable from untrusted networks; MikroTik's default configuration blocks this port from the internet, but manual rule changes are common in operator environments.
Key dates
References
- https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
- https://mikrotik.com/supportsec/september-2026-vulnerability/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-86060
- https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
- https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802
- https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801
Frequently asked questions
Does CVE-2026-86060 affect my FedRAMP authorization?
If MikroTik RouterOS runs inside your authorization boundary, yes. CVE-2026-86060 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its September 13, 2026 remediation deadline has already passed. For a FedRAMP-authorized service, an unpatched KEV in your boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your options are to remediate it immediately or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-86060?
Knox does not patch your software. Remediating MikroTik RouterOS is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. Applying the patch is yours to do. Managing your compliance posture while you do it is not something you have to handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. Exposure like CVE-2026-86060 surfaces during continuous monitoring rather than waiting to be flagged at an assessor review, giving your team earlier visibility into what needs attention.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-86060's remediation deadline of September 13, 2026 has passed. What happens now?
If CVE-2026-86060 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out and documenting why the deadline was missed is what keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
