CVE-2026-86060Vulnerability
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
Reported by 6 independent sources · first reported by CERT Polska · last reported
Last reported 11 days ago
Fix due 13 Sep 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 93% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
10 reports, newest first · the exact sentence from each-
September 2026 CVE Landscape“CVE-2026-86060”
-
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild“The second vulnerability to be added to the KEV catalog is CVE-2026-67279, which has been chained along with CVE-2026-86060, an argument injection flaw in the RouterOS login process, as part of an exploit codenamed MikroTrick.”
-
U.S. CISA adds Microsoft SharePoint and Mikrotik RouterOS flaws to its Known Exploited Vulnerabilities catalog“CERT Polska confirmed that the flaw is being actively exploited in the wild and that, when chained with CVE-2026-86060, it can lead to full administrative access without authentication.”
-
Mikrotik security advisory (AV26-887) – Update 2“Open-source reporting indicates that CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060 related to MikroTik are being exploited in the wild.”
-
AI Helps Uncover MikroTrick Attack Chain in MikroTik RouterOS“By comparing the patch with those logs, CERT Polska identified a new critical flaw, CVE-2026-86060, in about an hour and gave MikroTik a working proof of concept.”
-
MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key“… calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060).”
-
MikroTrick: technical analysis, disclosure process, and the use of LLM agents“Identifying CVE-2026-86060”
-
14th September – Threat Intelligence Report“MikroTik has fixed CVE-2026-67276 and CVE-2026-86060, RouterOS vulnerabilities that can be chained to obtain passwordless SSH access and elevate privileges to full administrator.”
-
Vulnerabilities in Mikrotik RouterOS software“CVE-2026-86060”
-
Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended“CVE-2026-86060 - SSH session privilege manipulation via a crafted username (CVSS: 9.2)”
Indicators reported together
named in the same reports- 82.192.72[.]4in 4 reports
- npratley[.]netin 2 reports
- 103.102.31[.]18in 2 reports
- idscan[.]netin 1 report
Copy these 4 indicators · defanged
Also named with it: CVE-2026-67279, CVE-2026-67276, CVE-2026-67277, CVE-2026-65660, CVE-2026-85046, CVE-2026-85880, CVE-2026-81963, CVE-2026-85706, CVE-2026-60004, CVE-2022-0847, CVE-2026-35273, CVE-2026-87491, CVE-2026-48710, CVE-2025-39964, CVE-2026-20316, CVE-2026-39987
Thanks — we review every report.