Listen to this Post
CVE-2026-86060 affects MikroTik RouterOS.
It is an argument-handling flaw.
It exists in the SSH login path.
The flaw involves usernames.
Those usernames begin with a prohibited character.
This can change the trusted RouterOS policy mask.
That change leads to privilege escalation.
Exploitation requires an unauthenticated SSH session.
The attacker must reach the RouterOS login helper.
The login helper processes username input.
Argument delimiters are not neutralized properly.
CWE-88 is Improper Neutralization of Argument Delimiters.
The command argument injection can alter policy.
Policy mask changes can bypass intended restrictions.
The trusted policy mask is normally set by login.
A prohibited character at username start triggers the issue.
The SSH session does not need valid credentials first.
The login helper is reachable before authentication.
The flaw is in argument handling, not password checks.
Affected versions include 6.x before 6.49.21.
Affected versions include 7.x before 7.23.4.
Affected versions include 7.24 before 7.24.2.
Fixed versions are 6.49.21, 7.23.4, and 7.24.2.
CISA added it to Known Exploited Vulnerabilities.
CISA added date is September 10, 2026.
CISA due date is September 13, 2026.
NVD published date is September 05, 2026.
NVD last modified date is September 11, 2026.
Source is CERT.PL.
The impact is privilege escalation on RouterOS.
DailyCVE Form:
Platform: MikroTik RouterOS
Version: Pre 6.49.21/7.23.4/7.24.2
Vulnerability : Argument injection escalation
Severity: Critical KEV listed
date: Sep 05 2026
Prediction: Sep 13 2026
(end of form)
What Undercode Say:
Analytics
grep -Ei 'CVE-2026-86060|RouterOS|argument injection' /var/log/.log ssh admin@ROUTER "/system resource print" ssh admin@ROUTER "/system package print" ssh admin@ROUTER "/ip service print" ssh admin@ROUTER "/ip firewall filter print" curl -s https://nvd.nist.gov/vuln/detail/CVE-2026-86060
Exploit: (Educational Purposes!)
ssh -o PreferredAuthentications=none -- '<prohibited_char>user'@TARGET ssh -o PreferredAuthentications=none -- '-CVE-2026-86060'@TARGET ssh admin@TARGET "/user print" ssh admin@TARGET "/system resource print"
Protection: from this CVE
ssh admin@ROUTER "/ip service disable ssh" ssh admin@ROUTER "/ip service set ssh address=TRUSTED_NET" ssh admin@ROUTER "/system package update install" ssh admin@ROUTER "/system reboot" echo "Fixed: 6.49.21 7.23.4 7.24.2"
Impact:
Privilege escalation
Policy mask change
Unauthenticated SSH
Known exploited
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
