Unauthenticated SSH login-path flaw changes RouterOS policy mask for full device takeover in MikroTik RouterOS (CVE-2026-86060)
CERT Polska and Italy's CSIRT both reported active exploitation of the MikroTrick RouterOS flaws within the last two days, and a router with SSH reachable from untrusted networks and still on an unfixed release can be taken over without credentials.
An argument-handling flaw in the RouterOS SSH login helper, triggered by usernames beginning with a prohibited character, lets an attacker with only an unauthenticated SSH session alter the trusted RouterOS policy mask and escalate to full control of the router. It is one of three related flaws (with CVE-2026-67276 and CVE-2026-67277) that MikroTik groups under the codename MikroTrick.
Affected: MikroTik RouterOS >= 7.24 < 7.24.2; MikroTik RouterOS >= 7.0.0 < 7.23.4; MikroTik RouterOS >= 6.0.0 < 6.49.21
How to Test
Check the running RouterOS version under System/Packages; anything below 6.49.21 (v6), 7.23.4 (7.x long-term) or 7.24.2 (7.24 stable) is vulnerable. Check whether SSH is reachable from untrusted networks. Inspect the Log section for a critical entry stating the device has been Flagged, and review the configuration for unknown scripts, users, or other settings you do not recognise.
How to Patch
Upgrade via System/Packages > Check For Updates to 6.49.21 (long-term v6), 7.23.4 (long-term v7), 7.24.2 (stable) or 7.25 beta 3; MikroTik notes the v6 branch is no longer actively developed and recommends moving to v7. Make a backup/export first. Independently, ensure SSH is not open to untrusted networks, restrict it to trusted IPs, or reach the router only over a VPN such as WireGuard. If the device shows Flagged status, follow MikroTik's Flagged status documentation; after upgrading, remove any unknown scripts, users, or configuration.