CVE-2026-86060: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command
This MikroTik advisory covers CVE-2026-86060 in MikroTik RouterOS.
- CVE-2026-86060
Key facts
- Vendor rating
- Critical, CVSS 9.2
- CISA KEV
- Listed ; federal due date
- Affected
- RouterOS 7.24 before 7.24.2; RouterOS 7.0.0 before 7.23.4; RouterOS 6.0.0 before 6.49.21
- Fixed in
- 7.24.2, 7.23.4, 6.49.21
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
CVE-2026-86060 in the CISA Known Exploited Vulnerabilities catalog
- CISA name:
- MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
- CISA description:
- MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.
- Required action:
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Description
MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels. This is an important security update.
Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information.
Your device should already give you the option to upgrade software in the “Check for updates” menu. Fix is included in: 7.25 beta 3.
7.24.2. 7.23.4.
6.49.21. For regular home device users the issue does not pose an immediate risk, but we still suggest all users to upgrade.
Steps to be taken Make sure SSH is not open to any untrusted networks. MikroTik default configuration blocks this port from the internet by default, but if you have manually opened this port, make sure only trusted IP can access it, or better yet, use a strong VPN like WireGuard to access your router and do not open any management ports at all.
RouterOS will check if your device has been compromised, and set it to “Flagged” status if it is. This will be written in the “Log” section.
Affected product named by the advisory: MikroTik RouterOS.
Text from the source record.
- RouterOS 7.24 before 7.24.2
- RouterOS 7.0.0 before 7.23.4
- RouterOS 6.0.0 before 6.49.21
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-86060
Upgrade to a fixed release named by MikroTik:
- 7.24.2
- 7.23.4
- 6.49.21
Support dates for the fixed release lines
- MikroTik RouterOS 6.49: support ended
More MikroTik advisories
CVE-2026-98432Nov 3, 2026MikroTik RouterOS: memory handling vulnerability has been identified in the Linux kernelCVE-2026-88464Oct 20, 2026MikroTik RouterOS: stack buffer overflow vulnerability has been identified in the SNMPCVE-2026-89020Sep 14, 2026MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-basedCVE-2026-67281Sep 5, 2026Unauthenticated file read in Mikrotik RouterOSCVE-2026-67279Sep 5, 2026SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOSCVE-2026-67277Sep 5, 2026Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
Get an email when MikroTik RouterOS publishes the next one.
See MikroTik RouterOS's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future MikroTik CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
