CVE-2026-67277 & CVE-2026-86060: MikroTik RouterOS Exploited in the Wild — CISA KEV Detection and Remediation Guide

On September 10, 2026, CISA added two MikroTik RouterOS vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild:

• CVE-2026-67277 — MikroTik RouterOS Missing Authentication for Critical Function vulnerability
• CVE-2026-86060 — MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command vulnerability (command/argument injection class)

This combination should get every network defender's attention immediately. A missing-authentication flaw paired with a command injection flaw is a classic pre-auth remote code execution chain: an unauthenticated attacker reaches a critical function, then abuses argument delimiter handling to execute arbitrary commands on the router. MikroTik devices sit at the network edge — as customer premises equipment (CPE), branch routers, VPN concentrators, and ISP infrastructure — which means a compromised RouterOS instance gives an adversary a pivot point with visibility into all transit traffic, DNS, and downstream network segments.

MikroTik RouterOS has a long and well-documented history of mass exploitation by botnets and state-aligned actors precisely because these devices are frequently internet-exposed, rarely monitored, and almost never onboarded into EDR. If you operate RouterOS anywhere in your environment — or your MSP/MSSP does — treat this as an emergency change request, not a routine patch cycle.

Under Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk, Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities on the directive's mandated timeline. Private-sector organizations should treat the KEV due date as their own de facto SLA — active exploitation means the dwell time clock started before you read this.

Technical Analysis

Affected Products

• Product: MikroTik RouterOS (RouterBOARD hardware, CHR virtual appliances, and x86 installations)
• Exposure surface: RouterOS services commonly reachable from untrusted networks, including the web management interface (WebFig, TCP 80/443), Winbox (TCP 8291), the RouterOS API (TCP 8728/8729), SSH (TCP 22), and FTP (TCP 21)

Consult the official MikroTik security advisories and changelogs for the exact affected version ranges and fixed releases: https://mikrotik.com/download and https://forum.mikrotik.com/. Do not assume your version is unaffected because it is "recent" — verify against the advisory explicitly. Devices running end-of-life RouterOS trains that will not receive a fix must be replaced or isolated.

Vulnerability Mechanics (Defender's View)

CVE-2026-67277 — Missing Authentication for Critical Function (CWE-306): A RouterOS component exposes a critical function that does not enforce authentication. This means an attacker with network reachability to the affected service can invoke privileged functionality without valid credentials. On a router, "critical function" typically translates to configuration manipulation, script execution, file access, or service control. The key defensive implication: network reachability is the only prerequisite. Any management interface exposed to the internet — or reachable from a compromised internal host — is a viable attack surface.

CVE-2026-86060 — Improper Neutralization of Argument Delimiters in a Command (CWE-88): RouterOS fails to properly sanitize argument delimiters before passing user-controlled input into a command execution context. An attacker can inject delimiter characters to break out of the intended argument scope and append attacker-controlled commands. This is the payload-delivery half of the chain.

Likely attack chain:

1. Attacker scans the internet (or an internal segment) for exposed RouterOS services (mass-scan tooling fingerprints RouterOS by banner, TLS cert, or HTTP response signatures trivially).
2. CVE-2026-67277 is used to reach the vulnerable function without credentials.
3. CVE-2026-86060 is used to inject OS-level commands via delimiter injection.
4. Post-exploitation on RouterOS typically includes: adding rogue admin accounts, enabling and abusing the RouterOS scripting/scheduler engine for persistence, modifying firewall/NAT rules for traffic redirection, standing up SOCKS proxies or tunnels, and exfiltrating or intercepting transit traffic.

Exploitation Status

• CISA KEV: Both CVEs are confirmed actively exploited — KEV inclusion is only issued with credible evidence of in-the-wild exploitation.
• Weaponization: Command-injection primitives on embedded network devices are rapidly absorbed into botnet tooling and initial-access broker playbooks. Expect scanning volume against RouterOS management ports to spike following public disclosure.
• CVSS: CISA's alert does not publish scores; check the NVD entries and MikroTik advisories as they are populated. Do not wait on a score to act — KEV listing supersedes severity scoring for prioritization.

Detection & Response

Network devices like RouterOS cannot run EDR agents, which makes log telemetry and network-layer detection your primary sensors. Forward RouterOS syslog to your SIEM (Syslog/CEF ingestion into Microsoft Sentinel works well), and monitor the management plane from your endpoints and network sensors.

Key observables for exploitation and post-exploitation of these CVEs:

• Unauthenticated or anomalous requests to RouterOS web/API endpoints, especially containing shell metacharacters (;, |, &&, $(), backticks) consistent with delimiter injection
• New or unexpected local user accounts on the device
• RouterOS scheduler entries or scripts you did not create (a classic persistence mechanism on compromised MikroTik gear)
• Configuration changes outside change windows: new firewall/NAT rules, enabled SOCKS/proxy services, modified DNS settings
• Outbound connections from the router to unfamiliar external IPs (C2, tunneling, or staging)
• Any endpoint in your environment initiating connections to Winbox (8291) or API (8728/8729) ports on devices outside the approved management-jump-host list

Sigma Rules

These rules target host- and network-visible behaviors around MikroTik exploitation: delimiter-injection patterns in web/proxy telemetry destined for RouterOS management interfaces, and lateral movement toward RouterOS management ports from non-jump-host systems.

---
title: Possible Argument Delimiter Injection Against RouterOS Management Interface
id: 3f8c1a92-7d54-4b6e-9a21-c4e5f6a7b801
status: experimental
description: Detects HTTP requests to MikroTik RouterOS web management paths containing shell metacharacters consistent with argument delimiter injection (CVE-2026-86060 class). Requires web/proxy or reverse-proxy telemetry in front of, or capturing, RouterOS management traffic.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/11
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/rest/'
      - '/jsproxy'
      - '/webfig'
  selection_delimiter:
    cs-uri-query|contains:
      - '%3B'
      - '%7C'
      - '%24%28'
      - '%60'
      - ';'
      - '|'
      - '$('
      - '`'
      - '%26%26'
      - '&&'
  condition: selection_uri and selection_delimiter
falsepositives:
  - Rare; legitimate RouterOS management API calls should not contain shell metacharacters
level: high
---
title: Endpoint Connection to MikroTik RouterOS Management Ports
id: 8b2e4d71-3c95-4a18-b762-d1a9f0e3c502
status: experimental
description: Detects endpoints initiating connections to MikroTik Winbox (8291) or API (8728/8729) management ports. In environments where administration is restricted to designated jump hosts, any other source indicates scanning, lateral movement, or post-exploitation device management by an attacker.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/09/11
tags:
  - attack.lateral_movement
  - attack.t1021
  - attack.t1046
logsource:
  category: network_connection
detection:
  selection:
    DestinationPort:
      - 8291
      - 8728
      - 8729
  condition: selection
falsepositives:
  - Legitimate network administration from approved jump hosts (allowlist by source IP)
  - Network monitoring/management platforms polling the RouterOS API
level: medium
---
title: RouterOS Syslog Indicating Configuration or Account Manipulation
id: 5a91c3e4-2f68-4d7b-8c49-e7b2a1d6f903
status: experimental
description: Detects RouterOS syslog messages indicating user account creation, scheduler/script changes, or firewall rule modifications — common post-exploitation actions on compromised MikroTik devices. Apply to ingested RouterOS syslog telemetry.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1136/
author: Security Arsenal
date: 2026/09/11
tags:
  - attack.persistence
  - attack.t1136
  - attack.t1053
logsource:
  category: syslog
detection:
  selection:
    message|contains:
      - 'user added'
      - 'scheduler'
      - 'script added'
      - 'script changed'
      - 'firewall rule added'
      - 'nat rule added'
      - 'changed by'
  condition: selection
falsepositives:
  - Legitimate administrative changes (tune by correlating with change-management windows and admin accounts)
level: medium

KQL — Microsoft Sentinel / Defender

The following query hunts for delimiter-injection patterns and suspicious access to RouterOS management services across ingested syslog/CEF network telemetry, plus Defender endpoint connections to management ports. Run it over at least the past 30 days for retro-hunting, then operationalize as an analytic rule.

let RouterOSPorts = dynamic([8291, 8728, 8729, 80, 443]);
let JumpHosts = dynamic(["10.0.0.5", "10.0.0.6"]); // REPLACE with approved management hosts
// Part 1: Endpoint connections to RouterOS management ports from non-jump hosts
let MgmtAccess =
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemotePort in (RouterOSPorts)
    | where LocalIP !in (JumpHosts)
    | summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by DeviceName, LocalIP, RemoteIP, RemotePort, InitiatingProcessFileName
    | where RemotePort in (8291, 8728, 8729); // strict mgmt ports only for high-fidelity
// Part 2: Syslog/CEF from RouterOS showing account, script, scheduler, or firewall changes
let DeviceChanges =
    Syslog
    | where TimeGenerated > ago(30d)
    | where SyslogMessage has_any ("user added", "script added", "script changed", "scheduler", "firewall rule added", "nat rule added")
    | project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage;
// Part 3: Possible delimiter injection strings observed in network/web telemetry toward routers
let InjectionAttempts =
    CommonSecurityLog
    | where TimeGenerated > ago(30d)
    | where RequestURL has_any (";", "%3B", "%7C", "%24%28", "%60", "%26%26")
    | where DestinationPort in (80, 443)
    | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, RequestMethod;
union MgmtAccess, DeviceChanges, InjectionAttempts
| sort by TimeGenerated desc

Velociraptor VQL

Use this artifact across your Windows/Linux fleet to identify hosts communicating with MikroTik management ports — useful for scoping lateral movement after a confirmed router compromise, and for finding unauthorized Winbox/API usage.

-- Hunt: Endpoint connections to MikroTik RouterOS management ports
-- Scope: Identify non-jump-host systems talking to Winbox (8291) or RouterOS API (8728/8729)
SELECT Pid,
       Name AS ProcessName,
       Exe AS ProcessPath,
       CommandLine,
       Username
FROM pslist()
WHERE Pid IN (
    SELECT Pid FROM netstat()
    WHERE RemotePort IN (8291, 8728, 8729)
      AND Status = 'ESTABLISHED'
)

Verification & Hardening Script

RouterOS devices cannot be patched from a Windows endpoint, so the practical automation is a Bash-based audit: SSH into each device, pull identity/version/config state, and snapshot the artifacts attackers typically modify (users, scheduler, scripts, NAT). Run this from a management host with SSH key auth against a device inventory.

#!/usr/bin/env bash
# RouterOS KEV exposure audit - CVE-2026-67277 / CVE-2026-86060
# Usage: ./routeros_audit.sh inventory.txt
# inventory.txt format: one device IP per line (SSH key auth assumed)

INVENTORY="$1"
OUTDIR="./routeros_audit_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTDIR"
SSH_OPTS="-o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new -o BatchMode=yes"

while read -r HOST; do
  [ -z "$HOST" ] && continue
  echo "[*] Auditing $HOST"
  OUT="$OUTDIR/$HOST.txt"
  {
    echo "=== IDENTITY / VERSION ==="
    ssh $SSH_OPTS admin@"$HOST" "/system identity print; /system resource print; /system package update print"
    echo "=== LOCAL USERS (look for unexpected accounts) ==="
    ssh $SSH_OPTS admin@"$HOST" "/user print detail"
    echo "=== SCHEDULER (persistence check) ==="
    ssh $SSH_OPTS admin@"$HOST" "/system scheduler print detail"
    echo "=== SCRIPTS (persistence check) ==="
    ssh $SSH_OPTS admin@"$HOST" "/system script print detail"
    echo "=== ENABLED SERVICES (disable unused mgmt plane) ==="
    ssh $SSH_OPTS admin@"$HOST" "/ip service print"
    echo "=== NAT RULES (traffic redirection check) ==="
    ssh $SSH_OPTS admin@"$HOST" "/ip firewall nat print detail"
    echo "=== DNS SETTINGS (hijack check) ==="
    ssh $SSH_OPTS admin@"$HOST" "/ip dns print"
    echo "=== ACTIVE CONNECTIONS ==="
    ssh $SSH_OPTS admin@"$HOST" "/ip firewall connection print count-only"
  } > "$OUT" 2>&1
  # Flag suspicious artifacts
  grep -Eiq 'socks|proxy enabled: yes|user added' "$OUT" && echo "[!] REVIEW $HOST: $OUT"
done < "$INVENTORY"

# Check internet exposure of mgmt ports from your egress perspective (sample scan)
echo "[*] Checking mgmt-port reachability for inventoried hosts"
while read -r HOST; do
  [ -z "$HOST" ] && continue
  for PORT in 8291 8728 8729 80 443 22; do
    timeout 3 bash -c "</dev/tcp/$HOST/$PORT" 2>/dev/null && echo "[!] $HOST:$PORT OPEN"
  done
done < "$INVENTORY"
echo "[*] Audit complete: $OUTDIR"

Remediation

Execute in this order — containment of exposed management surfaces should not wait on the maintenance window for the firmware upgrade.

1. Identify and inventory every RouterOS device. Include CHR instances in cloud environments, branch-office routers, and anything managed by third-party MSPs. Shadow deployments are common — validate against NetFlow/IPAM data, not just your asset register.
2. Upgrade RouterOS immediately to the fixed release specified in the MikroTik advisories for CVE-2026-67277 and CVE-2026-86060. Download only from https://mikrotik.com/download, verify the package, and confirm the running version post-reboot with /system resource print. If MikroTik has not yet published a fixed version for your release train, apply the workarounds below and monitor the MikroTik forum/security announcements hourly.
3. Remove management interfaces from untrusted networks. Restrict WebFig, Winbox, API, and SSH to a dedicated management VLAN or an allowlist of jump-host IPs via /ip service set ... address= plus input-chain firewall rules. Internet-exposed RouterOS management is the root enabler of mass exploitation — this is the single highest-value compensating control.
4. Disable unused services. Turn off FTP, Telnet, API (if Winbox/SSH suffices), and the www service where the REST/API surface isn't required.
5. Audit for compromise before and after patching. Patching does not evict an attacker. Review local users, /system scheduler, /system script, NAT rules, DNS settings, and certificates against known-good baselines (use the script above). On any confirmed compromise, treat the device as fully untrusted: export-and-review config, netinstall/re-image, rotate ALL credentials including those of downstream systems the router could observe, and review traffic logs for interception or redirection.
6. Rotate credentials on all devices that were internet-exposed, and enforce strong unique passwords plus key-based SSH. Disable the default admin account and create named per-administrator accounts.
7. Meet BOD 26-04 obligations. FCEB agencies must remediate within the directive's KEV timeline. Non-federal organizations: adopt the same deadline internally and track it through your vulnerability-management program with named ownership.
8. Operationalize detection long-term. Forward RouterOS syslog (at minimum system, critical, firewall topics) to your SIEM, deploy the Sigma/KQL content above as analytic rules, and baseline which hosts legitimately touch management ports so deviations alert cleanly.
9. Plan for end-of-life replacement. Devices on RouterOS trains that will not receive fixes cannot be made safe by configuration alone. Budget replacement now.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub