CVE-2026-86060: MikroTik RouterOS Argument Delimiter Injection Allows Policy Mask Privilege Escalation

Background

MikroTik RouterOS is the operating system that powers MikroTik’s widely deployed line of routers, switches, and wireless devices, used across small business, ISP, and enterprise networks worldwide for routing, firewalling, and network management. RouterOS exposes a rich command-line and API surface (accessible via Winbox, SSH, and the RouterOS API) that administrators use to configure virtually every aspect of the device, governed by a role-based policy system that assigns each user account a “policy mask” — the specific set of permissions (such as read, write, policy, test, password, sniff, sensitive, and others) that account is allowed to exercise.

Because RouterOS devices are frequently deployed at network edges and are directly reachable for remote management by design, the integrity of this policy/permission model is a core security boundary: it is what prevents a lower-privileged account from gaining administrative control of the device.

Technical Mechanism

CVE-2026-86060 is classified under CWE-88, Improper Neutralization of Argument Delimiters in a Command (argument injection). CISA’s description states the flaw “allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.”

Argument injection vulnerabilities occur when user-supplied input is passed into a command invocation without properly neutralizing characters that the receiving command interprets as argument separators or flag delimiters. Rather than injecting an entirely new command (as in classic OS command injection), the attacker injects additional arguments or flags into a command that is already being executed — tricking the command into taking an unintended action because of the extra, attacker-controlled parameters.

In the context of RouterOS’s policy mask, a plausible mechanism is:

1. An attacker with some level of access to a RouterOS command or API call supplies input that is incorporated into an internal command invocation related to user/group policy management
2. Because delimiter characters within that input are not properly neutralized, the attacker’s input is interpreted as additional arguments to the policy-management command rather than as a plain data value
3. These injected arguments modify the trusted policy mask associated with the attacker’s account (or another account), granting permissions the account was not legitimately assigned
4. With an elevated policy mask, the attacker can exercise RouterOS capabilities — such as full administrative configuration access — that were previously restricted

MikroTik’s advisory (published September 2026) is the authoritative source for the specific vulnerable command and required preconditions (such as what baseline access level, if any, is required to reach the vulnerable code path); this analysis presents the general CWE-88 mechanism and CISA’s stated privilege-escalation outcome without inventing the precise command syntax MikroTik has not made public in the data available here.

Real-World Exploitation Evidence

CVE-2026-86060 was added to CISA’s KEV catalog on 2026-09-10, confirming active exploitation in the wild under KEV listing criteria. CISA’s remediation deadline was 2026-09-13 — a three-day window.

knownRansomwareCampaignUse is listed as “Unknown.” CISA has not confirmed ransomware campaign use of this vulnerability at this time.

No specific threat actor or campaign has been publicly attributed to exploitation of CVE-2026-86060 based on the data available for this analysis. MikroTik RouterOS devices have historically been targeted at scale by botnet operators (for example, large-scale router botnets built from unpatched MikroTik devices have been documented in prior years), given the large installed base and frequent internet exposure of these devices; this is offered as general risk context for the product line and is not an attribution claim specific to this CVE.

Impact Assessment

A CVSS score of 9.8 for a privilege-escalation vulnerability on a network device typically reflects a scenario where the escalation path leads to full administrative control — consistent with a policy mask change that grants broad RouterOS permissions. Consequences include:

• Full device administrative control — an attacker who escalates their policy mask to administrative-equivalent permissions can reconfigure routing, firewall, NAT, and VPN settings on the device
• Network traffic manipulation — control of a router’s configuration allows traffic redirection, interception, or disruption for every network segment the device routes or firewalls
• Persistence and further pivot — administrative RouterOS access allows creation of additional accounts, scheduler-based backdoor scripts, or firmware-level persistence mechanisms, and provides a pivot point into every network reachable through the device
• Botnet recruitment risk — given this product line’s history as a target for large-scale router botnets, a privilege-escalation flaw that yields administrative control is a realistic enabler for mass device recruitment if exploited at scale

Sector-specific risk: MikroTik RouterOS devices are heavily used by ISPs and small/medium businesses as edge routers; ISPs running RouterOS-based customer-premises or aggregation equipment face a particularly large blast radius if this vulnerability is exploited at scale across their deployed device base.

Affected Versions

The KEV data does not specify an exact RouterOS version range. MikroTik’s advisory is authoritative:

Remediation Steps

CISA’s required action is to apply MikroTik’s vendor mitigations, in compliance with BOD 26-04 and Forensics Triage Requirements guidance, or discontinue use of the product if mitigation is unavailable.

1. Identify all RouterOS devices in the environment and their current RouterOS version:

/system package print
/system resource print

2. Apply the RouterOS update referenced in MikroTik’s September 2026 advisory to every affected device.
3. Audit existing user accounts and policy masks for unexpected permission grants that may already have been applied via exploitation prior to patching:

/user print detail
/user group print detail

4. Restrict administrative access surfaces (Winbox, API, SSH, web interface) to trusted management networks only, and disable any administrative services not actively required:

/ip service disable www,api,api-ssl
/ip service set winbox address=<trusted-management-range>

5. Perform forensic triage per CISA’s Forensics Triage Requirements guidance on any device that was reachable and unpatched during the exploitation window.

Detection Guidance

MikroTik has not published a specific public exploitation signature for this vulnerability in the data available for this analysis. Consult MikroTik’s advisory and your IDS/IPS vendor’s feed for CVE-2026-86060-specific detection content.

General indicators to review in the interim:

• Unexpected changes to user group policy masks (/user group print detail) not correlated with legitimate administrative change activity
• New user accounts or modified group memberships created outside of normal change-management windows
• RouterOS API or command-line sessions originating from unexpected source IP addresses, particularly those attempting policy/group-management commands
• Review RouterOS system logs (/log print) for anomalous command invocations around user/policy management functions preceding any unauthorized configuration change

Timeline

References

• MikroTik — September 2026 Vulnerability Advisory
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance — Forensics Triage Requirements
• NVD — CVE-2026-86060