Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-86060

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

9.8
CVSS 3.1
1
story
SEP 10
added to KEV
Severity
9.8 Critical · NVD score
Vendor
MikroTik
Product
RouterOS
Published
Sep 5, 2026
Added to KEV
Sep 10, 2026
KEV deadline
Sep 13, 2026
Ransomware use
Unknown
Weakness
CWE-88

What it is

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesMicroTik Routers Under Attack in New CampaignLabeled “MikroTrick” by researchers at CERT Polska who discovered and disclosed six vulnerabilities in the software,  the campaign targets devices with SSH services reachable from the public internetDENNIS FISHER · 3 MIN

Official references

7 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorymikrotik.com/supportsec/september-2026-vulnerabilityFixcert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploitedAnalysiscert.pl/en/posts/2026/09/mikrotik-routeros-cveExploitnpratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain