CISA has added two actively exploited MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalog and set a September 13 federal remediation deadline. Administrators with exposed management services should update immediately and check for compromise; installing a fixed release does not establish that a previously reachable router is clean.
What changed
The September 10 catalog update adds CVE-2026-86060, an SSH-session privilege-escalation flaw, and CVE-2026-67277, an unauthenticated bandwidth-test service flaw that can disclose kernel memory or restart a router. CISA’s inclusion means it has evidence that each vulnerability has been exploited, not merely that proof-of-concept code exists. The agency lists ransomware use as unknown for both.
MikroTik says fixes are available in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21. The vendor recommends upgrading through Check for updates, restricting SSH to trusted networks, and avoiding internet-exposed management ports.
The practical consequence
CERT Polska, which reported the flaws, says attackers have combined CVE-2026-86060 with CVE-2026-67276, a separate SSH authentication bypass, to take full control of RouterOS devices whose SSH service is reachable from public networks. CVE-2026-86060 can turn a crafted SSH username into a session with full administrative privileges. CVE-2026-67277 affects the bandwidth-test service and can leak kernel memory or cause a remote denial of service; CERT Polska does not identify it as part of the observed full-control chain.
After updating, administrators should review the RouterOS log and Flagged device status, then inspect users, scripts, scheduler tasks, proxy configuration, and tunnels for changes they do not recognize. MikroTik’s startup check disables selected known suspicious entries, but it is not a comprehensive forensic scan. If compromise is suspected, CERT Polska recommends isolating the device, preserving logs and configuration before a reset, rebuilding from a trusted configuration, and changing exposed passwords, keys, and other secrets.
Limits and evidence
The observed takeover chain requires SSH to be accessible from an untrusted network and targets an account through the paired authentication flaw. MikroTik’s default home-router configuration blocks internet access to SSH, so exposure is configuration-dependent, although the vendor still recommends that all users update. Temporary service restrictions reduce the attack surface but do not replace the patch.
The public notices do not establish the attackers’ identity, victim count, campaign scale, or ransomware involvement. The absence of a Flagged marker does not prove that a device was never compromised, while the marker itself does not prove which vulnerability was used. DrComps did not reproduce the vulnerabilities or attacks. CERT Polska’s CVSS scores of 9.2 for CVE-2026-86060 and 8.8 for CVE-2026-67277 are severity assessments, not performance benchmarks; no benchmark applies to this security update.