CVE-2026-86060

Executive Summary

CVE-2026-86060 is a critical argument-injection flaw (CWE-88) in the MikroTik RouterOS SSH login path that allows an unauthenticated remote attacker to manipulate the trusted RouterOS policy mask and escalate privileges. Any Internet- or LAN-exposed RouterOS SSH service running a version prior to 6.49.21, 7.23.4, or 7.24.2 is affected and must be treated as compromised until patched. The vulnerability carries a CVSS v3.1 base score of 9.8, has a public proof-of-concept, and has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-09-13, indicating active exploitation in the wild.

Technical Analysis

The vulnerability class is Improper Neutralization of Argument Delimiters in a Command (CWE-88). Per the NVD description, RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character. When a specially crafted username is supplied, the flaw allows the trusted RouterOS policy mask to be changed, resulting in privilege escalation. Exploitation requires only an unauthenticated SSH session that can reach the RouterOS login helper — no valid credentials are required to trigger the vulnerable argument-handling logic.

The attack surface is the SSH login path (the pre-authentication username parsing/login helper). Because the flaw resides in how the login path handles a username beginning with a "prohibited character," it is an injection-style weakness in which attacker-controlled input crosses an argument boundary and is interpreted by the RouterOS login helper as something other than a literal username. The specific effect described by the CNA is privilege escalation via modification of the trusted RouterOS policy mask — a RouterOS construct that governs which policies (permissions) apply to a session or user. By altering the policy mask before authentication is completed, the attacker subverts the intended permission model.

The description does not disclose a specific character, parameter name, function name, or code path. Consistent with the accuracy constraints of this report, no such detail is fabricated here; the mechanism is characterized at the vulnerability-class level. The issue was fixed across all three maintained release trains — 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable) — which is consistent with a login-path parsing flaw rather than a version-specific feature regression.

From a root-cause perspective, CWE-88 flaws occur when user input is passed into a command or argument parser without delimiting or escaping metacharacters. In the RouterOS SSH login context, the username field is the only attacker-controlled input available pre-authentication, making it the logical injection vector. The pre-auth, network-reachable nature of the flaw explains the CVSS score of 9.8: AV:N (network), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction), S:U (unchanged scope), with High confidentiality, integrity, and availability impact.

Exploitation Scenarios

The attack chain below is described strictly at the vulnerability-class level, anchored to the stated trigger (an SSH username beginning with a prohibited character reaching the RouterOS login helper). No public exploit code or Nuclei template exists per the provided data, though a public PoC is reported; the chain is therefore inferred from the vulnerability class and CNA description.

1. Reconnaissance / target identification. An attacker scans for exposed RouterOS SSH services. RouterOS typically exposes SSH on TCP/22 (and management on 8291); the attacker enumerates banners or uses Shodan-style queries such as product:"RouterOS" to identify candidate hosts. No authentication is needed at this stage.

2. Triggering the specific flaw. The attacker opens an unauthenticated SSH session to the target and supplies a username that begins with the prohibited character referenced in the CNA description. The username is delivered as the SSH authentication username field and reaches the RouterOS login helper, where the argument-handling flaw is triggered. Because the flaw is in argument handling rather than credential verification, the attacker does not need valid credentials.

3. Payload / execution method (vulnerability-class level). The crafted username is interpreted by the login helper such that the trusted RouterOS policy mask is changed. In other words, the injected argument alters the session's permission/policy context. The attack does not rely on a memory-corruption payload or a buffer overflow; it exploits argument delimiter neutralization (CWE-88), so the "payload" is the malformed username string itself.

4. Post-exploitation impact. With the policy mask modified, the attacker obtains privileges beyond those intended for an unauthenticated session, enabling configuration changes, credential manipulation, routing/firewall modification, and potential lateral movement from the compromised router into the network it manages. Given the High C/I/A subscores, full compromise of the device's confidentiality, integrity, and availability is the expected worst case.

Impact Assessment

Affected systems are MikroTik RouterOS deployments running versions earlier than 6.49.21, 7.23.4, or 7.24.2, with the SSH service reachable by an attacker. Because the flaw is unauthenticated and network-reachable, any Internet-exposed RouterOS SSH endpoint is a direct target; internal-segment exposure also matters for lateral movement.

CVSS v3.1 base score 9.8 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:

• Attack Vector Network: exploitable remotely over SSH.
• Attack Complexity Low: no race condition or special conditions.
• Privileges Required None: unauthenticated.
• User Interaction None: no victim action needed.
• Scope Unchanged: impact confined to the vulnerable RouterOS component/device.
• Confidentiality/Integrity/Availability High: full device compromise, including sensitive configuration, credentials, routing/firewall rules, and device availability.

Business blast radius: MikroTik routers are widely deployed as edge/CPE devices. A compromised router can be used for traffic interception, DNS/route manipulation, persistence, botnet recruitment, and as a pivot into protected internal networks. EPSS is low (0.00401, ~33.6th percentile), but inclusion in CISA KEV and the existence of a public PoC — combined with a pre-auth Critical rating — means the practical risk is high and prioritization should follow KEV guidance rather than EPSS alone.

Detection Guidance

The following detections target the SSH login path and anomalous authentication behavior consistent with username-based argument injection. Because the exact prohibited character is not disclosed, rules use behavioral heuristics (non-standard username strings, repeated pre-auth failures, policy-mask changes) rather than a literal payload string.

Sigma Rule

title: MikroTik RouterOS SSH Login Argument Injection Attempt (CVE-2026-86060)
id: 5f1c0a2e-9d3b-4a77-9c21-8b1a2f3c6d90
status: experimental
description: Detects SSH authentication attempts against RouterOS using usernames that begin with shell/argument delimiter characters consistent with CWE-88 argument injection in the login helper.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86060
author: valtersit.com
date: 2026-01-01
logsource:
  product: linux
  service: sshd
detection:
  selection_username:
    message|re: 'Invalid user (-|--|;|\||&|\$|\(|\)|`|\x27|\x22|\{)'
  selection_routeros:
    message|contains: 'sshd'
  condition: selection_username and selection_routeros
falsepositives:
  - Legitimate usernames beginning with a hyphen are rare but possible; tune per environment.
level: high
tags:
  - attack.t1190
  - attack.initial_access
  - cve.2026-86060

YARA Rule

rule CVE_2026_86060_RouterOS_SSH_Login_ArgInjection
{
    meta:
        author = "valtersit.com"
        description = "Detects argument-injection style SSH usernames targeting MikroTik RouterOS login helper (CVE-2026-86060)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86060"
        date = "2026-01-01"
    strings:
        $ssh_banner = "SSH-2.0-ROSSSH" ascii nocase
        $delim1 = /Invalid user [-;|&$()`'"]/ ascii
        $delim2 = /user [-;|&$()`'"]/ ascii
    condition:
        uint16(0) == 0x5342 or ($ssh_banner and any of ($delim*))
}

Suricata IDS Rule

alert ssh any any -> any 22 (msg:"CVE-2026-86060 MikroTik RouterOS SSH login argument-injection attempt"; flow:to_server,established; content:"SSH-"; depth:4; pcre:"/^[-;|&$()`'\"]/R"; metadata:service ssh, cve CVE-2026-86060; reference:cve,2026-86060; classtype:attempted-admin; sid:9100001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where process.name == "sshd" and event.action == "ssh_login_attempt"]
  [network where process.name == "sshd" and event.outcome == "failure" and
     wildcard(user.name, "[-;|&$()`'\"]*")]

Splunk SPL Query

index=os sourcetype=linux_secure ("sshd" OR "Invalid user")
| regex _raw="Invalid user [-;|&$()`'\"]"
| stats count values(user) as attempted_users by src_ip, host
| where count >= 3
| table _time, host, src_ip, attempted_users, count

Wazuh OSSEC Rule

<group name="mikrotik,sshd,">
  <rule id="910001" level="12">
    <decoded_as>sshd</decoded_as>
    <match>Invalid user</match>
    <regex>Invalid user [-;|&amp;\$\(\)`'\"]</regex>
    <description>CVE-2026-86060: MikroTik RouterOS SSH login argument-injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The NVD description reports fixes in 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable); no independent vendor advisory or workaround was provided.

1. Immediate mitigations:

• Disable or restrict SSH access on RouterOS devices: apply firewall rules that only permit SSH from trusted management networks; block TCP/22 from untrusted/Internet sources.
• Audit current RouterOS versions against the fixed releases and prioritize Internet-facing devices.
• Monitor SSH authentication logs for usernames beginning with unusual/delimiter characters and for unexpected policy-mask or user-privilege changes.
• Given CISA KEV status and a public PoC, assume compromise of any unpatched, exposed device and conduct forensic review of configuration, users, and firewall/routing rules.

2. Patch/upgrade steps:

• Upgrade Long-term branch devices to 6.49.21 or 7.23.4 as appropriate for the installed train.
• Upgrade Stable branch devices to 7.24.2.
• Verify the running version post-upgrade and reboot if required. Because patch confidence is only "CLAIMED" from a single source, confirm the fixed version against MikroTik's official release notes before relying on it.

3. Long-term hardening:

• Enforce management-plane segmentation and least-privilege access for all RouterOS administrative interfaces.
• Disable unused services (SSH, Winbox, API, HTTP) and restrict remaining ones to trusted source addresses.
• Maintain a patch SLA aligned with CISA KEV deadlines (remediate by 2026-09-13 per KEV).
• Centralize RouterOS and SSH logs for continuous detection of argument-injection and privilege-change events.

References

• NVD — CVE-2026-86060: https://nvd.nist.gov/vuln/detail/CVE-2026-86060
• CISA Known Exploited Vulnerabilities Catalog (MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability; remediate by 2026-09-13): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CWE-88 — Improper Neutralization of Argument Delimiters in a Command: https://cwe.mitre.org/data/definitions/88.html
• MikroTik RouterOS release/download channel (verify fixed versions 6.49.21, 7.23.4, 7.24.2 against official release notes): https://mikrotik.com/download
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Note on exploit-in-the-wild evidence: A public proof-of-concept is reported (POC_STATUS: Public), though no Nuclei template or public exploit code was provided in the intelligence dataset. Inclusion in CISA's KEV catalog is the primary indicator of active exploitation; no specific threat actor campaign was identified in the supplied data.