MikroTik RouterOS SSH Argument Injection Privilege Escalation Vulnerability (CVE-2026-86060)
Executive & SecOps Summary
SECOPS ASSESSMENTMikroTik RouterOS versions 6.x and 7.x prior to security patches.
Unauthenticated remote attackers can manipulate the trusted policy mask via specially crafted SSH usernames, leading to full privilege escalation.
Immediately upgrade to versions 6.49.21, 7.23.4, or 7.24.2 and restrict SSH access to trusted source IPs.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Firmware Upgrade:
/system package update check-for-updates
/system package update install- Temporary Mitigation (Restrict SSH Access):
If immediate patching is not possible, restrict SSH access to a specific management subnet.
/ip service set ssh address=<TRUSTED_ADMIN_IP_RANGE>
# Or disable SSH if not required for management
/ip service disable ssh- Firewall Hardening:
Ensure the SSH port (default 22) is not exposed to the public internet.
/ip firewall filter add chain=input protocol=tcp dst-port=22 action=drop in-interface-list=WANStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
The vulnerability stems from an improper neutralization of argument delimiters (CWE-88) within the RouterOS SSH login helper component. By initiating an SSH session with a username starting with prohibited characters, an attacker can inject arguments that alter the internal policy mask of the operating system. This bypasses standard authentication and authorization controls, granting the attacker elevated privileges without valid credentials. Given its inclusion in the CISA KEV catalog and a high EPSS score of 0.94, this flaw is actively being exploited in the wild to compromise network infrastructure and establish persistence.
Official Vendor Advisories & References
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.