CVE-2026-86060 · High · CISA KEV

MikroTik RouterOS Privilege Escalation (KEV): Policy Mask Manipulation

Threat Engine Auto-Feed · data current as of 2026-09-11

A critical vulnerability in MikroTik RouterOS (CVE-2026-86060) allows attackers to manipulate argument delimiters, leading to privilege escalation by altering the trusted RouterOS policy mask. This flaw is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog. Organizations using MikroTik RouterOS are at immediate risk.

  • CVSS:
  • EPSS percentile: 0.50738
  • Exploitation pressure: 55/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 51th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves an 'improper neutralization of argument delimiters'. In simple terms, the software fails to correctly handle special characters or sequences used to separate commands or arguments. An attacker can inject these unhandled characters to bypass intended security controls, effectively tricking the system into executing unauthorized commands or modifying critical settings, such as the RouterOS policy mask, which controls permissions and trusted operations.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Any organization utilizing MikroTik RouterOS devices, particularly those in critical network infrastructure roles.
  • Financial services and Technology sectors, given historical targeting by relevant threat actors.

Misconfigurations that escalate it

  • Lack of regular security audits and updates for network infrastructure devices.
  • Insufficient network segmentation, allowing easier lateral movement post-exploitation.

High-impact scenarios

  • Privilege escalation on network routers, leading to full control over network traffic and configurations.
  • Unauthorized policy changes, potentially allowing attackers to bypass security controls, establish persistence, or exfiltrate data.
  • Disruption of network services or re-routing of traffic for malicious purposes.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor MikroTik RouterOS devices for unusual policy changes or unauthorized command executions.
  • Regularly review system logs for suspicious activity related to user privileges or configuration modifications.
  • Implement network intrusion detection systems (NIDS) to flag anomalous traffic patterns originating from or directed at MikroTik devices.

Contain

  • Isolate affected MikroTik RouterOS devices from critical network segments if immediate patching is not feasible.
  • Restrict administrative access to MikroTik devices to only necessary personnel and IP addresses.
  • Implement strong access controls and multi-factor authentication for all administrative interfaces.

Patch

  • Apply the latest security updates and patches released by MikroTik for RouterOS immediately.

Frontier verdict — High

CRITICAL: Actively exploited privilege escalation in MikroTik RouterOS, requiring immediate patching to prevent network compromise.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.