CISA adds MikroTik RouterOS flaws to Known Exploited Vulnerabilities catalog

CISA added two MikroTik RouterOS vulnerabilities, CVE-2026-67279 and CVE-2026-86060, both rated 9.2 and reported as chained in exploitation, to its Known Exploited Vulnerabilities catalog. CERT Polska warned of attacks in the wild; fixes are available in versions 6.49.21, 7.23.4 and 7.24.2.

• CVE-2026-67279 and CVE-2026-86060 are rated 9.2
• CVE-2026-86060 is parameter injection in the SSH login path leading to privilege escalation
• Fixed releases: RouterOS 6.49.21, 7.23.4 or 7.24.2
• CERT Polska confirmed exploitation in the wild