CVE-2026-86060: MikroTik RouterOS Argument Injection Actively Exploited — Detection and Remediation Guide

On September 10, 2026, CISA added CVE-2026-86060 to the Known Exploited Vulnerabilities (KEV) catalog — which means this is not a theoretical risk. Threat actors are actively exploiting an improper neutralization of argument delimiters in a command (CWE-88, argument injection) flaw in MikroTik RouterOS in the wild right now.

The mechanics of this bug should concern every network defender: exploitation allows an attacker to modify the trusted RouterOS policy mask, resulting in unauthorized privilege gain. In practical terms, a low-privileged RouterOS account — the kind routinely handed out for read-only monitoring, helpdesk access, or API integrations — can be leveraged to seize full administrative control of the router. From there, an adversary owns your traffic: credential interception, traffic redirection, VPN tampering, lateral movement staging, and persistent footholds on infrastructure that almost never gets EDR coverage.

MikroTik devices sit at the edge of thousands of SMB, ISP, and enterprise networks, and they are perennial favorites for botnet operators and state-aligned actors precisely because they are powerful, internet-exposed, and chronically under-monitored. If you run RouterOS anywhere in your environment, treat this as an emergency change, not a routine patch cycle.

Technical Analysis

Affected Products

• Product: MikroTik RouterOS (all hardware platforms running RouterOS, including CHR — Cloud Hosted Router — deployments)
• Affected versions: Organizations should consult the official MikroTik advisory and the CISA KEV entry for the precise version floor. As a rule of thumb in every RouterOS incident I've worked: if you are not on the latest stable or long-term release train published after the vendor fix, assume you are vulnerable.
• Attack surface: Any RouterOS instance where an attacker can reach a management or service interface (Winbox, WebFig, API, SSH) with low-privileged credentials — including internet-exposed management planes and compromised internal accounts.

Vulnerability Class: Argument Injection (CWE-88)

CVE-2026-86060 is an improper neutralization of argument delimiters in a command vulnerability. RouterOS internally constructs commands from user-supplied input. When delimiter characters embedded in that input are not properly neutralized, an attacker can break out of the intended argument context and inject additional command arguments that the underlying parser executes with elevated trust.

The documented impact is specific and dangerous: modification of the trusted RouterOS policy mask. RouterOS enforces authorization through per-user policy masks (read, write, test, sniff, sensitive, api, winbox, web, ssh, ftp, reboot, policy, password, romon, dude, local, telnet). By abusing the argument injection flaw, an attacker holding a restricted account can rewrite their own policy mask — or another user's — to grant full administrative capabilities. That is privilege escalation by design abuse, and it bypasses the entire intent of RouterOS role-based access control.

Attack Chain (Defender's View)

1. Initial access: Attacker authenticates to a RouterOS service (Winbox 8291, API 8728/8729, SSH 22, WebFig 80/443) using a low-privileged account — harvested via phishing, default/credential stuffing, a compromised monitoring service account, or an insider.
2. Exploitation: A crafted command containing malicious argument delimiters is submitted through the vulnerable component, causing RouterOS to parse attacker-controlled arguments.
3. Privilege escalation: The trusted policy mask is modified; the restricted account now carries effective full/admin-equivalent policy.
4. Post-exploitation: Attacker creates persistence (new admin users, scheduled scripts, modified firewall rules, SOCKS proxy or tunnel configurations), harvests credentials, and pivots into the internal network.

Exploitation Status

• CISA KEV: Confirmed — added 2026-09-10
• In-the-wild exploitation: Confirmed active per CISA
• Federal mandate: Binding Operational Directive (BOD) 26-04 applies — Federal Civilian Executive Branch agencies must remediate within the KEV-specified timeline and comply with CISA's Forensics Triage Requirements. Private-sector organizations should treat the KEV deadline as their own benchmark.

Detection & Response

RouterOS does not run EDR agents. Your detection strategy has three pillars: (1) syslog telemetry off the device, (2) network-level visibility into management-plane access, and (3) endpoint-side hunting for the tooling attackers use to reach your routers. If your MikroTik devices are not forwarding logs to a SIEM today, that gap is your first remediation item — you cannot detect what you cannot see.

Key observables for this CVE:

• RouterOS log entries indicating user account or policy modification (user ... changed, account topic events, unexpected policy field changes) — especially by accounts that should be read-only
• Logins to management services (winbox, api, ssh, web) from source IPs outside your designated management network or jump hosts
• New user creation, scheduler/script creation, or firewall/NAT rule changes following a low-privilege session
• Endpoint processes like winbox.exe or API clients executing from hosts that have no business managing routers

The following Sigma rules target the two highest-fidelity behaviors: policy-mask tampering visible in syslog, and management-plane access from unauthorized sources.

---
title: RouterOS User Policy or Account Modification Event
id: 3f9c2e71-8a4d-4b6e-9f21-7c5d8e0a1b34
status: experimental
description: Detects RouterOS syslog events indicating user account or policy mask modification, consistent with CVE-2026-86060 post-exploitation privilege escalation activity.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1098
logsource:
  product: mikrotik
  service: routeros
detection:
  selection:
    Message|contains:
      - 'policy'
      - 'changed'
  filter_legitimate_admin:
    Message|contains:
      - 'via winbox'
      - 'via ssh'
  condition: selection and not filter_legitimate_admin
falsepositives:
  - Legitimate administrator changes made through standard management channels during change windows
level: high
---
title: MikroTik Management Interface Access from Non-Management Source
id: 8b2d5f43-1e7a-4c9b-a6d3-2f8e9c0b4d56
status: experimental
description: Detects inbound connections to MikroTik management services (Winbox, API, API-SSL) from sources outside approved management networks. Relevant to initial access for CVE-2026-86060 exploitation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1133
logsource:
  category: firewall
detection:
  selection_dst_port:
    DestinationPort:
      - 8291
      - 8728
      - 8729
  selection_action:
    Action: allow
  condition: selection_dst_port and selection_action
falsepositives:
  - Approved jump hosts and network management systems — filter these at the SIEM layer by source IP allowlist
level: medium

The KQL query below hunts RouterOS syslog forwarded into Microsoft Sentinel (via a Linux syslog collector or CEF) for account/policy modification events and correlates them with logins from unusual sources — the exact sequence you'd expect from CVE-2026-86060 exploitation.

// Hunt for RouterOS policy mask tampering and suspicious account changes
// Assumes RouterOS syslog ingestion via Syslog or CommonSecurityLog (CEF)
let ManagementSubnets = dynamic(["10.0.99.0/24", "192.168.88.0/24"]); // TODO: replace with your approved management networks
let SuspiciousRouterOSEvents = Syslog
| where TimeGenerated > ago(14d)
| where Computer has_any ("router", "mikrotik", "chr") or SyslogMessage has "routeros"
| where SyslogMessage has_any ("policy", "user", "changed", "added")
    and SyslogMessage has_any ("account", "system")
| project TimeGenerated, Computer, SyslogMessage, HostIP;
SuspiciousRouterOSEvents
| join kind=leftouter (
    CommonSecurityLog
    | where TimeGenerated > ago(14d)
    | where DestinationPort in (8291, 8728, 8729, 22)
    | where DeviceVendor =~ "MikroTik" or DeviceProduct has "RouterOS"
    | where not(ipv4_is_in_range(SourceIP, ManagementSubnets[0]))
      and not(ipv4_is_in_range(SourceIP, ManagementSubnets[1]))
    | summarize LoginsFromUnapprovedSources = count(), SourceIPs = make_set(SourceIP)
      by DestinationHostName, bin(TimeGenerated, 1h)
) on $left.Computer == $right.DestinationHostName
| extend AlertContext = iff(isnotempty(LoginsFromUnapprovedSources), "POLICY CHANGE + UNAPPROVED LOGIN SOURCE — INVESTIGATE", "Policy/account change — validate against change records")
| project TimeGenerated, Computer, SyslogMessage, SourceIPs, AlertContext
| order by TimeGenerated desc

Velociraptor is your endpoint-side lens here. Attackers (and admins) reach MikroTik devices from workstations and jump boxes. This artifact hunts for Winbox execution and active connections to MikroTik management ports from endpoints — any hit on a host that isn't a network engineering workstation or approved jump host is a strong investigative lead.

-- Hunt for MikroTik management tooling and connections from endpoints
-- Expected: network admin workstations and jump hosts only. Anything else = investigate.

SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)winbox'
   OR CommandLine =~ '(?i)(winbox|mikrotik|8291)'

UNION ALL

SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE FALSE  -- placeholder to keep single result-set shape

// Connections to MikroTik management ports (Winbox 8291, API 8728/8729)
SELECT Pid, Name, Raddr, Rport, Status
FROM netstat()
WHERE Rport in (8291, 8728, 8729)
  AND Status =~ 'ESTABLISHED'

Verification & Hardening Script

Run this from a management station against each RouterOS device over SSH. It inventories users and their effective policy masks (your primary indicator of successful exploitation — an account that quietly gained policy, write, or full rights), checks the running version, and reviews exposed services. Any account whose policy mask expanded without a corresponding change record is a compromise indicator — treat the device as breached and follow your IR process, including CISA's Forensics Triage Requirements.

#!/bin/bash
# CVE-2026-86060 RouterOS verification & hardening audit
# Usage: ./routeros_audit.sh <router_ip> <ssh_admin_user>
# Requires: sshpass or key-based auth to the device

ROUTER="$1"
ADMIN="$2"

if [ -z "$ROUTER" ] || [ -z "$ADMIN" ]; then
  echo "Usage: $0 <router_ip> <ssh_admin_user>"; exit 1
fi

echo "===== [1] RouterOS version (verify against vendor-fixed release for CVE-2026-86060) ====="
ssh "${ADMIN}@${ROUTER}" '/system resource print; /system package update print'

echo "===== [2] User accounts and policy masks — flag anything with write/policy/test/sniff/sensitive that should be read-only ====="
ssh "${ADMIN}@${ROUTER}" '/user print detail where name!=""'

echo "===== [3] Accounts with elevated or full policy ====="
ssh "${ADMIN}@${ROUTER}" ':foreach u in=[/user find] do={ :local p [/user get $u policy]; :if ($p ~ "write|policy|test|sniff|sensitive") do={ :put ([/user get $u name] . " -> " . $p) } }'

echo "===== [4] Scheduler and scripts (common persistence after privilege escalation) ====="
ssh "${ADMIN}@${ROUTER}" '/system scheduler print detail; /system script print detail'

echo "===== [5] Enabled IP services — disable winbox/api/web/ftp/telnet if not required ====="
ssh "${ADMIN}@${ROUTER}" '/ip service print where disabled=no'

echo "===== [6] Recent configuration history / logged changes ====="
ssh "${ADMIN}@${ROUTER}" '/system history print; /log print where topics~"account|critical|error"'

# Hardening examples (review before executing — change windows apply):
# ssh ${ADMIN}@${ROUTER} '/ip service set winbox address=10.0.99.0/24'   # restrict winbox to mgmt subnet
# ssh ${ADMIN}@${ROUTER} '/ip service disable api,api-ssl,ftp,telnet,www' # kill unused services
# ssh ${ADMIN}@${ROUTER} '/user set [find name=monitoring] policy=read'   # enforce least privilege

echo "===== Audit complete. Cross-reference all user/policy/scheduler findings against change records. ====="

Remediation

1. Patch immediately. Upgrade RouterOS to the fixed release identified in the official MikroTik advisory (mikrotik.com/download and the vendor security announcement list). Use the stable or long-term train; verify the changelog explicitly references the fix for CVE-2026-86060 before assuming coverage. CISA KEV inclusion means federal agencies are operating under a BOD 26-04 remediation deadline — adopt that same deadline internally, and follow CISA's Forensics Triage Requirements for evidence preservation on potentially affected devices before wiping or upgrading.

2. If you cannot patch: Per the KEV required action, apply vendor mitigations or discontinue use of the device. For RouterOS, meaningful interim mitigation includes removing low-privileged accounts entirely, disabling the vulnerable management path, and restricting management-plane reachability to a dedicated jump host over a management VRF/VLAN. If the device is internet-managed, it should be considered compromised until patched and audited.

3. Audit for existing compromise — assume breach posture. Review every user account's policy mask against documented intent. Pull /system history, /log, scheduler entries, scripts, and recent firewall/NAT changes. Any unexplained policy expansion, new account, or scheduled script = invoke your IR plan. Do not assume patching erases persistence — attackers who escalated privileges before you patched may have already created admin accounts or scripts that survive the upgrade.

4. Lock down the management plane permanently:

   • Restrict Winbox/API/SSH/WebFig to an RFC-1918 management subnet via /ip service set <name> address= and input-chain firewall rules
   • Disable every service you don't operationally need (api, api-ssl, ftp, telnet, www, www-ssl if WebFig is unused)
   • Enforce least-privilege policy masks — read-only accounts should have only read (plus the minimum transport policy), never write or policy
   • Rotate all RouterOS credentials, especially any low-privileged account that could have reached the vulnerable command path

5. Ship the logs. Configure /system logging action to forward syslog (especially the account, system, critical, and firewall topics) to your SIEM. Devices added to the KEV are exactly the ones adversaries revisit — retention matters for both detection and the forensic obligations under BOD 26-04's triage requirements.

6. Segment and monitor. MikroTik routers frequently sit at network trust boundaries. Ensure your SOC has NetFlow/firewall visibility into traffic to and from these devices, and alert on any management-port connection from outside your approved source list — that single control would have surfaced the initial access for this CVE in most environments.

MikroTik exploitation is a marathon, not a sprint, for adversaries — once they own the router, they own the road everything travels on. Patch, audit policy masks, and get your logs off the device.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub