1. Executive summary
CVE-2026-86060 is a critical (CVSS 9.2, CWE-88 argument injection) privilege-escalation vulnerability in MikroTik RouterOS that allows an attacker to modify the trusted RouterOS policy mask. It is not currently listed in CISA's Known Exploited Vulnerabilities catalogue and carries an EPSS score of 0%, meaning no observed exploitation at time of writing — but the advisory record carries a CISA due date of 2026-09-13, indicating federal-sector urgency. A related MikroTik RouterOS flaw (CVE-2026-67277, missing authentication in the btest service causing kernel memory disclosure and DoS) shares the same 2026-09-13 due date, suggesting a coordinated MikroTik patch cycle. EMEA financial services clients running RouterOS on perimeter or branch infrastructure should treat this as a high-priority patch item on any internet-exposed or multi-tenant RouterOS device.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The existence of an unpatched vulnerability with no observed exploitation does not, by itself, trigger incident classification, reporting, or third-party assessment obligations under the articles in scope. Clients should nonetheless track patch status under their general ICT risk-management and resilience-testing regimes.
3. Technical analysis & attack chain
Confirmed mechanism (from NVD/CISA advisory text)
- An attacker with access to the RouterOS command interface supplies a command with improperly neutralized argument delimiters (CWE-88, argument injection).
- The injected arguments allow the attacker to change the trusted RouterOS policy mask — the internal control governing which policy groups (e.g.
sensitive,reboot,write,policy) a user or process is trusted to hold. - With an altered policy mask, the attacker escalates privileges beyond their legitimate authorisation, up to full administrative control of the device.
What this means in practice: RouterOS policy masks are the mechanism by which the OS enforces administrative separation — including the sensitive policy that gates access to secrets such as stored credentials and certificate key material. An attacker who can rewrite the policy mask can grant themselves policies their account was never issued, effectively bypassing RouterOS's administrative RBAC. This is a privilege-escalation flaw, not a pre-authentication remote code execution vector: the attacker needs an existing foothold on the device (a valid account or an already-compromised session) to exploit it.
Related GitHub advisory context (single-sourced, lower confidence): A CWE-88 argument-injection advisory (GHSA-265c-qw8p-8m9f) describes a comparable flaw class where malicious arguments supplied as backup configuration parameters cause remote code execution by an attacker holding a privileged account. The GitHub advisory does not explicitly bind itself to CVE-2026-86060, and the NVD record for this CVE does not describe the backup-configuration vector — treat the backup-parameter delivery path as unconfirmed for this specific CVE until MikroTik's own changelog is reviewed. Both descriptions agree on the core flaw: argument delimiters are not neutralized, and a privileged or semi-privileged account can escalate.
Related MikroTik flaw in the same patch window: CVE-2026-67277 (missing authentication for a critical function in the btest service) permits kernel memory disclosure and denial of service. This is a distinct vulnerability but shares the 2026-09-13 CISA due date; clients patching RouterOS this cycle should address both.
Not established in the source material: specific affected RouterOS versions, the exact command or interface through which the injection occurs, exploit availability, in-the-wild exploitation, and any threat-actor attribution. No MITRE ATT&CK profile exists for any actor here, and no actor is named — there is no attribution to assess.
4. Mitigation & containment
P1 — within 24 hours
- Inventory all MikroTik RouterOS devices (perimeter routers, branch CPE, lab/edge devices). RouterOS appears in financial services networks most often as branch-office edge or as management-network routing; confirm none are forgotten in DMZs.
- Identify internet-exposed RouterOS management interfaces (Winbox port 8291, API 8728/8729, SSH 22, web 80/443) and restrict management access to trusted admin subnets via firewall rules and
ip serviceaddress restrictions. This limits the reachable attack surface for any account an attacker holds. - Review local user accounts and their policy assignments (
/user print); remove stale or over-privileged accounts. The vulnerability escalates from an existing account, so account hygiene directly shrinks the exploit path.
P2 — within 72 hours
- Apply the MikroTik RouterOS fix once identified in the vendor's release notes; the CISA advisory requires mitigation per vendor instructions with a 2026-09-13 due date. Pin to the latest stable release in the current branch — do not remain on a version predating the fix.
- Patch CVE-2026-67277 in the same maintenance window (btest service missing-authentication). If the
btestbandwidth-test service is not used, disable it entirely:/tool btest server→ set to disabled, and block UDP/TCP ports used by btest at the perimeter. - Rotate administrative credentials on all RouterOS devices after patching, on the assumption that a policy-mask escalation could have exposed
sensitive-policy material (stored secrets, keys) on any previously compromised host.
P3 — within 7 days
- Verify patch deployment across the estate and confirm the policy mask on each device reflects expected user policies (
/user printand/user group print). - Add MikroTik RouterOS version and patch status to the recurring third-party/edge-device review cycle. Where RouterOS devices are supplied or managed by an MSP or network partner, obtain written confirmation of patch status — this is a supply-chain visibility point for outsourced branch networking.
5. Indicators of compromise
No indicators of compromise available in the source material.
Behavioural indicators (derived from the vulnerability mechanism, not from observed intrusions):
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Modification of user policy assignments or group policy masks outside change-control windows | RouterOS /user print, /user group print history; configuration backup diffs |
Moderate — mechanism-derived, not observed |
Administrative commands issued from accounts newly holding sensitive or policy policies they were not previously granted |
RouterOS logging (/system logging), syslog server |
Moderate |
| Unexpected btest service sessions (CVE-2026-67277) | RouterOS firewall/connection tracking for btest ports; /tool btest session logs |
Moderate |
6. Detection
Insufficient indicators to author detection rules.
The source material provides no command strings, file artefacts, registry keys, mutexes, or network signatures specific to exploitation of this vulnerability. A YARA or Sigma rule built from the advisory text would only match reporting about the CVE, not exploitation. Recommend instead monitoring for the behavioural indicators in §5 via RouterOS syslog forwarding to the client SIEM.
CVE assessment
1 referenced CVE — 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-86060 | 9.2 Critical | — | 0% | RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, a… |
7. Sources
- NVD — CVE-2026-86060 — MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command — https://nvd.nist.gov/vuln/detail/CVE-2026-86060 — 2026-09-09
- NVD — CVE-2026-67277 — MikroTik RouterOS Missing Authentication for Critical Function (btest) — https://nvd.nist.gov/vuln/detail/CVE-2026-67277 — (corpus, undated)
- GitHub Security Advisories — GHSA-265c-qw8p-8m9f — CWE-88 Argument Injection via backup configuration parameters — https://github.com/advisories/GHSA-265c-qw8p-8m9f — (corpus, undated)
8. Adverse Trace position
CVE-2026-86060 is a genuine critical-severity privilege-escalation flaw (CVSS 9.2, CWE-88) but, per the verified reference data, shows no evidence of exploitation: it is absent from CISA KEV and scores 0% EPSS. We assess the practical risk to EMEA financial services as moderate — the flaw requires an existing account on the device, which constrains opportunistic attack, but the payoff (policy-mask rewrite, full administrative control of edge routing infrastructure) is high, and RouterOS devices are frequently under-monitored edge assets. The 2026-09-13 CISA due date and the simultaneous btest vulnerability suggest an active MikroTik patch cycle that defenders should ride now rather than wait for exploitation to surface. The backup-configuration RCE vector described in the related GitHub advisory is single-sourced and not yet tied to this CVE — we will verify against MikroTik's official changelog and update this advisory if the version list or exploit path is confirmed. Clients should prioritise internet-exposed and MSP-managed RouterOS assets for patching within the week.
Published via PulseTrace — Adverse Trace threat intelligence.