Security1 hSeptember 26, 2026, 16:20

CVE-2026-86060 in RouterOS: admin takeover without credentials

CERT Polska detailed CVE-2026-86060 in MikroTik RouterOS, an argument-injection flaw in the login helper that grants an unauthenticated attacker a full-policy console. The fix shipped in the September 2026 RouterOS releases, and 9,559 devices with SSH-exposed RouterOS were found online.

DEV Community

Open source

CVE-2026-86060 in RouterOS: admin takeover without credentials

CVE-2026-86060 is an argument-injection flaw in the RouterOS login helper
A username of -2 makes the process read attacker-supplied values
Mask 655358 grants the RouterOS full group policy
Fixed in the September 2026 RouterOS releases

#MikroTik#RouterOS

Two RouterOS Bugs, One Escalation Path: What CVE-2026-67277 and CVE-2026-86060 Mean for Edge Routers

Security

Patching Guide: Closing the CVE-2026-67276 SSH Authentication Bypass on MikroTik Routers

Security

CISA adds Microsoft SharePoint and MikroTik RouterOS flaws to KEV catalog

Security

CVE-2026-86060 in RouterOS: admin takeover without credentials

Two RouterOS Bugs, One Escalation Path: What CVE-2026-67277 and CVE-2026-86060 Mean for Edge Routers

Patching Guide: Closing the CVE-2026-67276 SSH Authentication Bypass on MikroTik Routers

CISA adds Microsoft SharePoint and MikroTik RouterOS flaws to KEV catalog

MikroTik patches three RouterOS flaws, including SSH auth bypass