CVE-2026-86060 · RouterOS contains an argument-handling flaw in the SSH login path i…

01 · The Real Story

Someone left a master key mold in the lock — and burglars are already copying it across 100K+ front doors

CVE-2026-86060 is an argument-injection flaw (CWE-88) in the MikroTik RouterOS SSH login helper. When a username begins with a specific prohibited character (the dash -), the login helper passes it unsanitized to an internal command-line utility. The attacker-controlled string manipulates the trusted RouterOS policy mask for the SSH session, escalating to full administrative privileges — no valid credentials required. Affected versions span RouterOS 6.0.0 through 6.49.20, 7.0.0 through 7.23.3, and 7.24 through 7.24.1. Fixed in 6.49.21, 7.23.4, and 7.24.2. When chained with CVE-2026-67276 (SSH authentication bypass via RSA exponent-one forgery, CVSS 9.2), the pair — dubbed MikroTrick by CERT Polska — delivers unauthenticated full admin on any RouterOS device with SSH reachable.

There is no vendor CVSS for CVE-2026-86060 specifically. MikroTik's release notes mentioned only an 'important security update' with zero detail — researchers reverse-engineered the patches using AI diffing and identified six bugs including two critical ones. The absence of a vendor score understates the danger. This is a pre-authentication privilege escalation on a network edge appliance with a public PoC, active in-the-wild exploitation since September 2 (one day *before* patches dropped), and 122,000–300,000 SSH-exposed devices visible to Shadowserver and Shodan. The reality is unambiguously CRITICAL.

"Pre-auth SSH argument injection hands attackers full admin on internet-facing MikroTik routers already under active exploitation."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Identify SSH-exposed RouterOS device

The attacker scans the internet for MikroTik RouterOS SSH banners on port 22 (or custom ports). Shodan, Censys, and FOFA all index RouterOS banners. Shadowserver measured 122,500+ devices with SSH exposed in a single 24-hour scan window on 2026-09-05. Some estimates reach 300,000.

Conditions required:

RouterOS device has SSH service listening on a public-facing interface

Where this breaks in practice:

Devices behind a carrier-grade NAT or firewall with SSH disabled are unreachable
Some ISPs filter port 22 outbound

Detection/coverage: Shodan/Censys/Shadowserver scanning; GreyNoise tags for MikroTik SSH probes

STEP 02

Forge SSH authentication (CVE-2026-67276)

The attacker exploits CVE-2026-67276: RouterOS checks SSH RSA key type and modulus but omits the exponent during public-key matching. The attacker supplies a key with exponent=1, forges a valid signature against a known authorized RSA modulus, and authenticates as an existing user without possessing the private key. This opens a fully authenticated SSH channel.

Conditions required:

Target device has at least one user with an RSA public key configured for SSH (common default)
CVE-2026-67276 is unpatched

Where this breaks in practice:

Devices using password-only SSH auth (no RSA keys configured) require a different entry path — but CVE-2026-86060 alone can still escalate at the login prompt
Devices running patched firmware (>=6.49.21, >=7.23.4, >=7.24.2) are immune

Detection/coverage: Log entry: login failure for user -2 from via ssh is the canonical IOC

STEP 03

Inject crafted username for policy mask escalation (CVE-2026-86060)

The attacker sends a username beginning with a dash character (e.g., -2) to the SSH login helper. The login helper passes the username unsanitized to an internal CLI utility, which interprets the leading dash as an argument flag. This manipulates the trusted RouterOS policy mask for the session, granting the attacker full administrative privileges — bypassing any role restrictions the authenticated user had.

Conditions required:

SSH session established (via CVE-2026-67276 or any other means)
CVE-2026-86060 is unpatched

Where this breaks in practice:

None — the injection is trivial once SSH is reachable. The PoC is public and weaponized.

Detection/coverage: Log IOC: user creation by ssh:-2@ entries in system log; new unauthorized admin account (commonly named ops)

STEP 04

Establish persistent admin access

With full admin privileges, the attacker creates a new admin account (observed: ops), installs SSH keys for persistence, and may modify firewall rules to maintain access while blocking competing attackers. The attacker now owns the network edge device.

Conditions required:

Full admin session from step 3

Where this breaks in practice:

None at this stage — the attacker has unrestricted RouterOS admin

Detection/coverage: Monitor for new user accounts, SSH key additions, firewall rule changes, and configuration export diffs

STEP 05

Pivot into internal network

A compromised MikroTik router provides the attacker with traffic interception (packet sniffing, DNS hijacking), VPN tunnel creation into the internal LAN, man-in-the-middle positioning for credential harvesting, and a persistent beachhead for lateral movement. In enterprise deployments, MikroTik devices often serve as VPN concentrators, site-to-site tunnel endpoints, or branch office gateways — compromise equals network-level access.

Conditions required:

Router has routes/interfaces to internal networks (nearly universal)

Where this breaks in practice:

Internal network segmentation and east-west monitoring may limit blast radius post-pivot

Detection/coverage: NetFlow/traffic anomaly detection; unexpected VPN tunnels; DNS query redirection alerts

03 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	CONFIRMED ACTIVE since September 2, 2026 — one day before MikroTik released patches on September 3. CERT Polska identified two attacker IPs: `82.192.72.4` and `103.102.31.18`. Campaign creates admin account `ops` on compromised devices.
Proof of Concept	Public. The MikroTrick PoC was disclosed alongside the CERT Polska advisory. Researchers reverse-engineered the patch diff using AI tooling. Exploit code indexed on Sploitus.
EPSS Score	0.00401 (low, but EPSS lags active exploitation — this score will rise sharply)
KEV Status	Not yet listed as of 2026-09-08. Given confirmed active exploitation, KEV addition is expected imminently.
CVSS Vector (estimated)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` — network-adjacent, no privileges required when chained with CVE-2026-67276, no user interaction, full CIA impact. Estimated base ~9.8 for the chain; ~8.8 standalone (PR:L).
Affected Versions	RouterOS 6.0.0–6.49.20, 7.0.0–7.23.3, 7.24–7.24.1. Essentially every RouterOS version shipped in the last decade.
Fixed Versions	6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable), 7.25beta3 (Development)
Exposure Data	Shadowserver: 122,500+ MikroTik devices with SSH exposed (24h scan, 2026-09-05). Other estimates via Shodan reach ~300,000. MikroTik's total installed base is estimated at several million devices worldwide.
Disclosure Timeline	2026-09-02: exploitation observed in the wild. 2026-09-03: MikroTik releases patches (silent fix). 2026-09-05: CERT Polska publishes advisory naming MikroTrick and six CVEs. 2026-09-07: Help Net Security and others report widespread exploitation.
Reporting Researcher	CERT Polska (own research). Patch diff analysis performed independently by multiple researchers using AI-assisted binary diffing.

04 · The Call

noisgate verdict.

Final Verdict

= UNCHANGED to CRITICAL (9.4/10)

The single most decisive factor is role identity: MikroTik RouterOS is canonically a network edge appliance, and this pre-authentication chain delivers full administrative control over the device to an unauthenticated remote attacker — confirmed actively exploited in the wild with a public PoC and 100K+ exposed devices. Compromise of a network edge device yields traffic interception, VPN pivot into internal networks, and persistent beachhead — fleet-scale blast radius for any organization relying on MikroTik at the perimeter.

HIGH Vulnerability existence and exploitability

HIGH Active in-the-wild exploitation

MEDIUM Exact exposed population count (122K–300K range)

Why this verdict

Pre-auth remote exploitation: When chained with CVE-2026-67276 (the companion RSA exponent-one bypass), CVE-2026-86060 is reachable without any credentials. The attacker needs only TCP connectivity to the SSH port — no passwords, no keys, no user interaction.
Active exploitation with public PoC: Attacks began September 2, 2026 — before patches were available. The MikroTrick PoC is publicly indexed. This is not theoretical; devices are being compromised right now.
Massive exposed attack surface: 122,500–300,000 MikroTik devices have SSH exposed to the internet per Shadowserver and Shodan. The affected version range covers essentially every RouterOS release of the last decade.
Role multiplier: MikroTik RouterOS runs exclusively on network edge devices — routers, firewalls, VPN concentrators, wireless controllers. This is not a workstation bug. 100% of the installed base occupies the high-value network-edge role by definition. Compromise yields: traffic interception, DNS hijacking, credential harvesting via MITM, VPN tunnel creation into internal networks, and persistent beachhead for lateral movement. Blast radius: network-level → potentially domain/fleet-level for organizations using MikroTik as their primary perimeter device. This floors the verdict at CRITICAL per the network edge appliance rule.
Zero friction in the chain: The argument injection is trivial (send a username starting with -), the PoC is weaponized, and the chain requires no special conditions beyond SSH reachability. No EDR, no endpoint agent, no host-level control exists on RouterOS to impede exploitation.

Why not higher?

The score is already 9.4. A perfect 10.0 would require zero mitigation options; here, disabling SSH on the WAN interface or applying firewall rules to restrict SSH access immediately neutralizes the attack vector. The chain also requires SSH to be internet-exposed — devices behind a properly configured upstream firewall are not directly reachable.

Why not lower?

Downgrading below CRITICAL is not defensible. The affected component is canonically a network edge appliance (100% of installs are routers/firewalls), the chain is pre-auth and remotely exploitable, exploitation is confirmed active in the wild with a public PoC, and the exposed population exceeds 100,000 devices. There are no friction points that narrow the reachable population below the CRITICAL floor threshold — the only prerequisite (SSH exposed) is met by at least 122,500 devices already.

05 · Compensating Control

What to do — in priority order.

Disable SSH on all WAN/public-facing interfaces immediately — The entire MikroTrick chain requires SSH reachability. Disabling SSH on public interfaces is the single highest-impact mitigation. Use /ip firewall filter add chain=input in-interface-list=WAN protocol=tcp dst-port=22 action=drop or disable the SSH service entirely if not needed. Deploy within 3 days per noisgate mitigation SLA for CRITICAL.
Restrict SSH access to management VLAN or VPN-only — If SSH must remain enabled, bind it to a management interface and restrict source IPs using firewall rules. Use /ip service set ssh address=10.0.0.0/24 to limit to your management subnet. This eliminates the internet-exposed attack surface.
Audit for IOCs of existing compromise — Check logs for login failure for user -2 from via ssh and user added by ssh:-2@. Look for unauthorized accounts (especially ops). Export and diff running config against known-good baseline. Compromised devices should be wiped and reinstalled from clean firmware — do not trust a config restore alone.
Apply firmware update to fixed versions — Update to RouterOS 6.49.21, 7.23.4, or 7.24.2 (or newer). Schedule emergency maintenance windows. For large fleets, use MikroTik's /system package update or The Dude for batch deployment. Complete remediation within 90 days per noisgate remediation SLA for CRITICAL.
Enable configuration change alerting — Configure RouterOS to send syslog or SNMP traps on user creation, SSH key addition, and firewall rule changes to your SIEM. This provides detection for post-exploitation persistence even if the initial compromise is missed.

What doesn't work

EDR/endpoint agents — RouterOS runs on proprietary hardware (RouterBOARD) or as a minimal Linux-derived OS with no support for third-party security agents. There is no host-based detection or prevention layer available.
WAF or IPS signatures — the exploit occurs within an encrypted SSH channel. No network-layer inspection device can see the crafted username payload without terminating the SSH session, which is not feasible for management traffic.
Password rotation — CVE-2026-67276 bypasses RSA key authentication entirely (exponent-one forgery), and CVE-2026-86060 manipulates the policy mask at the login prompt. Changing passwords does not address either flaw.
Rate limiting SSH connections — the exploit requires only a single SSH session to succeed. Rate limiting slows brute-force attacks but does not prevent a single crafted login attempt.

06 · Verification

Crowdsourced verification payload.

Run this script from any Linux/macOS workstation that can reach the target MikroTik device's SSH port. Usage: bash check_mikrotik_cve2026_86060.sh <router_ip> [port]. Requires ssh client installed. No authentication needed — the script checks the SSH banner to identify RouterOS version.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash\n# check_mikrotik_cve2026_86060.sh — Check MikroTik RouterOS for CVE-2026-86060\n# Usage: bash check_mikrotik_cve2026_86060.sh <host> [port]\n# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN\n\nset -euo pipefail\n\nHOST=\"${1:?Usage: $0 <host> [port]}\"\nPORT=\"${2:-22}\"\n\n# Grab SSH banner (timeout 5s)\nBANNER=$(ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=no \\\n  -p \"$PORT\" \"$HOST\" 2>&1 | head -5 || true)\n\n# Alternative: use nc/ncat for banner grab if ssh client fails\nif [ -z \"$BANNER\" ]; then\n  BANNER=$(echo '' | timeout 5 nc -w5 \"$HOST\" \"$PORT\" 2>/dev/null || true)\nfi\n\nif [ -z \"$BANNER\" ]; then\n  echo \"UNKNOWN — could not connect to $HOST:$PORT\"\n  exit 2\nfi\n\n# Check if it's RouterOS\nif ! echo \"$BANNER\" | grep -qi 'mikrotik\\|routeros\\|ROSSSH'; then\n  echo \"UNKNOWN — host does not appear to be MikroTik RouterOS\"\n  echo \"Banner: $BANNER\"\n  exit 2\nfi\n\necho \"[*] Detected MikroTik RouterOS on $HOST:$PORT\"\necho \"[*] Banner: $BANNER\"\n\n# Try to extract version from banner or use API\n# RouterOS SSH banners typically show version in the banner string\nVERSION=$(echo \"$BANNER\" | grep -oP '[0-9]+\\.[0-9]+\\.?[0-9]*' | head -1)\n\nif [ -z \"$VERSION\" ]; then\n  echo \"UNKNOWN — could not extract RouterOS version from banner\"\n  echo \"Manual check: connect via WinBox/WebFig and verify version is >= 6.49.21 (v6) or >= 7.23.4 (v7)\"\n  exit 2\nfi\n\necho \"[*] Detected version: $VERSION\"\n\n# Parse major.minor.patch\nMAJOR=$(echo \"$VERSION\" | cut -d. -f1)\nMINOR=$(echo \"$VERSION\" | cut -d. -f2)\nPATCH=$(echo \"$VERSION\" | cut -d. -f3)\nPATCH=${PATCH:-0}\n\n# Version comparison\nif [ \"$MAJOR\" -eq 6 ]; then\n  if [ \"$MINOR\" -lt 49 ] || ([ \"$MINOR\" -eq 49 ] && [ \"$PATCH\" -lt 21 ]); then\n    echo \"VULNERABLE — RouterOS $VERSION is affected (fixed in 6.49.21)\"\n    exit 1\n  else\n    echo \"PATCHED — RouterOS $VERSION is >= 6.49.21\"\n    exit 0\n  fi\nelif [ \"$MAJOR\" -eq 7 ]; then\n  if [ \"$MINOR\" -eq 24 ]; then\n    if [ \"$PATCH\" -lt 2 ]; then\n      echo \"VULNERABLE — RouterOS $VERSION is affected (fixed in 7.24.2)\"\n      exit 1\n    else\n      echo \"PATCHED — RouterOS $VERSION is >= 7.24.2\"\n      exit 0\n    fi\n  elif [ \"$MINOR\" -lt 23 ] || ([ \"$MINOR\" -eq 23 ] && [ \"$PATCH\" -lt 4 ]); then\n    echo \"VULNERABLE — RouterOS $VERSION is affected (fixed in 7.23.4)\"\n    exit 1\n  else\n    echo \"PATCHED — RouterOS $VERSION is >= 7.23.4\"\n    exit 0\n  fi\nelse\n  echo \"UNKNOWN — unexpected major version $MAJOR\"\n  exit 2\nfi

07 · Bottom Line

If you remember one thing.

TL;DR

Treat this as a drop-everything emergency. CVE-2026-86060 is actively exploited in the wild as part of the MikroTrick chain, with a public PoC and 100K+ exposed devices. Monday morning: (1) Immediately audit all MikroTik devices for SSH exposed to the internet and disable WAN-facing SSH within hours — this is your noisgate mitigation SLA for CRITICAL (≤3 days), but given active exploitation you should not wait even that long. (2) Check every device for IOCs: look for unauthorized accounts (especially ops), log entries mentioning user -2, and unexpected firewall or config changes — any compromised device must be wiped and rebuilt from clean firmware. (3) Begin firmware upgrades to 6.49.21 / 7.23.4 / 7.24.2 across your fleet under the noisgate remediation SLA for CRITICAL (≤90 days), prioritizing internet-facing and site-to-site VPN devices first. If you have MikroTik at your perimeter, assume you are a target *right now*.

Sources

Peer Review

What defenders are saying.

Submit a review attribution: handle + country only

0 flags selected · stored anonymously

Validation Results

Crowdsourced verification outputs.

Results submitted by users who ran the verification payload against their environment.