CTI · reported · 2026-09-15

Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1068 Exploitation for Privilege Escalation Privilege Escalation

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: MikroTik RouterOS Exploitation via CVE-2026-67277 or CVE-2026-86060
id: f6a7b8c9-0d1e-2f3a-4b5c-6d7e8f9a0b1c
status: experimental
description: Detects exploitation attempts against MikroTik RouterOS devices targeting CVE-2026-67277 (unauthenticated info disclosure) and CVE-2026-86060 (argument injection privilege escalation), observed in MikroTrick campaign.
references:
  - https://malware.news/al26-020-mikrotik-routeros-vulnerabilities
  - https://censys.com/mikrotik-routeros-cves
author: Tia N. List
date: 2026-09-15
tags:
  - attack.initial-access
  - attack.t1190
  - attack.privilege-escalation
  - attack.t1068
logsource:
  category: authentication
  product: windows
detection:
  selection_mikrotik_auth:
    ServiceName: 'ssh'
    IpAddress|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  selection_mikrotik_api:
    ServiceName: 'www'
  condition: selection_mikrotik_auth or selection_mikrotik_api
falsepositives:
  - Legitimate MikroTik device administration
  - Authorized network management access
level: medium

References

• https://malware.news/al26-020-mikrotik-routeros-vulnerabilities
• https://censys.com/mikrotik-routeros-cves