CVE-2026-86060 is an actively exploited flaw in MikroTik RouterOS, the network operating system that runs MikroTik routers and other network-edge devices. It turns an SSH login attempt into a route for changing the device's trusted privilege policy: an attacker who can reach the RouterOS SSH login helper does not need an existing account first.
That matters because these devices sit at a network boundary. They commonly handle routing and remote administration, so control of one can give an intruder a durable foothold at the point where an organisation's internal and external networks meet. RouterOS is run by organisations and network administrators that deploy MikroTik equipment; the available material does not identify particular sectors as especially exposed.
A username changes the policy mask
The defect is improper handling of argument delimiters in the SSH login path. Put more simply, RouterOS passes a supplied username through a login helper in a way that does not safely neutralise special argument-separating characters. A username beginning with a prohibited character can manipulate how that helper interprets the request.
The result is not merely a failed login or an account-name trick. The crafted input can change RouterOS's trusted policy mask, the set of permissions the system relies on when deciding what an authenticated session may do. That creates a privilege-escalation path: an attacker can obtain permissions beyond those that should be available through the login process and take control of the affected device.
The stated prerequisite is network reachability to an unauthenticated SSH session on RouterOS. Teams should therefore treat Internet-exposed SSH as the most immediate exposure, while remembering that internal reachability can still be enough for an attacker already present on a network. The supplied material does not say whether SSH is enabled by default, which RouterOS hardware models are affected, or whether another prior foothold is needed after the policy mask is altered.
Exploitation makes patching the first job
The flaw is marked as exploited in the wild and was added to the Known Exploited Vulnerabilities catalog on September 10, 2026. A public proof of concept is not described in the material provided, so no public proof of concept has surfaced here. The practical risk does not depend on one: the reported active exploitation and unauthenticated entry point are enough to prioritise remediation.
MikroTik fixed the issue in RouterOS 6.49.21 for the Long-term release train, 7.23.4 for Long-term, and 7.24.2 for Stable. Inventory every RouterOS instance, identify its release channel and version, and move to the applicable fixed version as soon as change controls allow. Do not assume a router is safe because it is not directly Internet-facing; check management networks, site-to-site paths and any SSH exposure created for support or automation.
Until upgrades are complete, restrict SSH management access to tightly controlled administrator source addresses or a dedicated management network, and disable SSH where it is not needed. Review router logs and configuration changes for unexpected SSH sessions, new administrative access, or policy and account changes, though the supplied advisory details do not specify detection indicators.
For teams that depend on these devices, this is a straightforward edge-management exposure with a particularly bad outcome: a login field can rewrite the rules that govern privilege. Tracking the real RouterOS versions in use is the useful control; SecAlerts monitors an organisation's actual software stack and alerts on new vulnerabilities affecting the products it runs.
