CVE-2026-86060
Received Received - Intake

RouterOS SSH Username Handling Privilege Escalation

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: CERT.PL

Description
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-06
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86060
EUVD
EUVD-2026-72029

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mikrotik routeros 6.49.21
mikrotik routeros 7.23.4
mikrotik routeros 7.24.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RouterOS has a flaw in its SSH login process where usernames starting with a prohibited character can alter the trusted RouterOS policy mask, leading to unauthorized privilege escalation. This requires an unauthenticated SSH session to access the login helper.

Detection Guidance

Detecting this vulnerability requires checking RouterOS versions for affected releases (6.49.21, 7.23.4, 7.24.2) and monitoring SSH login attempts with usernames starting with prohibited characters. Use RouterOS CLI commands like /system package print to check versions and /log print to review SSH login logs for suspicious activity.

Impact Analysis

An attacker could exploit this to gain elevated privileges on affected RouterOS devices, potentially taking control of the system, intercepting traffic, or disrupting network operations.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or system compromise, violating confidentiality and integrity requirements in GDPR, HIPAA, and other standards.

Mitigation Strategies

Immediately update RouterOS to fixed versions: 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable). Disable unauthenticated SSH access to the RouterOS login helper if possible. Restrict SSH access to trusted IP addresses and monitor for unauthorized login attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86060. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart