The US Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities affecting MikroTik RouterOS to its Known Exploited Vulnerabilities Catalog.
The first issue, CVE-2026-86060, arises from insufficient sanitization of command argument delimiters. Exploitation requires an attacker to reach the SSH login helper within an established session; once there, the attacker can modify trusted RouterOS policy masks, resulting in privilege escalation.
The second vulnerability, CVE-2026-67277, stems from missing authentication in critical RouterOS functions. An unauthenticated attacker can establish a connection before authentication completes, potentially disclosing kernel memory contents or triggering denial-of-service conditions.
CISA instructed US federal agencies to remediate both flaws no later than September 13 and to investigate any evidence of compromise associated with CVE-2026-86060. The agency warned that the vulnerabilities are likely to see wider exploitation and advised all organizations running affected MikroTik products to review their exposure.
