Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-88
Descriptions
KEV: MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation.
NVD: RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
warncomponent_extraction: Component 'RouterOS SSH login helper — argument handling in username parsing' matches or contains product name 'RouterOS' — no specific component identified
Hunting hypothesis agent
Hunt RouterOS logs for SSH usernames starting with a hyphen (e.g. `-2`) and the pattern `login failure for user -2` followed by `user <name> added by ssh` — the MikroTrick privilege escalation chain via CVE-2026-67276 and CVE-2026-86060.
Research details
ComponentRouterOS SSH login helper — argument handling in username parsing
PreconditionsUnauthenticated SSH access to the RouterOS login helper on a vulnerable version (6.0.0–6.49.20, 7.0.0–7.23.3, 7.24.0–7.24.1). Typically chained with CVE-2026-67276 (SSH pubkey bypass) which requires knowledge of a target username and its RSA public modulus. Default MikroTik configuration blocks SSH from the internet, but many deployments manually expose it. agent
Exploit notesThe public PoC (dinosn/mikrotrick-poc) focuses on CVE-2026-67276 (SSH pubkey bypass via e=1 forgery using paramiko). CVE-2026-86060 is the privilege escalation step in the MikroTrick chain, activated via a crafted SSH username starting with a prohibited character (e.g. '-2') that manipulates the RouterOS policy mask. The full chain is actively exploited in the wild since at least 2 September 2026. Attackers create a user named 'ops' after gaining admin. CERT Polska chose not to publish the full exploit details to buy patching time. The PoC repo is a lab tool for the pubkey bypass half of the chain; no standalone 86060 PoC has been published.
SummaryMikroTik RouterOS contains an argument injection flaw in the SSH login helper where crafted usernames (starting with a prohibited character like "-2") manipulate the policy mask to grant full admin privileges. It is actively exploited as part of the "MikroTrick" chain (CVE-2026-67276 + CVE-2026-86060), with confirmed compromises since September 2026 creating a rogue "ops" account. Patched in 7.24.2, 7.23.4, and 6.49.21; MikroTik added a "Flagged" compromise-detection mechanism.
Tia coverage
First reported2026-09-03
First exploit report2026-09-07
Exploit report → KEV3 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.