~/news/2026-09-10-mikrotik-routeros-privilege-escalation.md

What happened. CISA added two MikroTik RouterOS flaws to the Known Exploited Vulnerabilities catalog on 2026-09-10, based on evidence of active exploitation: CVE-2026-86060, a privilege escalation, and CVE-2026-67277, missing authentication in the btest service. MikroTik had already shipped fixes under the codename MikroTrick.

Why it matters. RouterOS sits at the edge of a great many networks, on hardware cheap enough that nobody has been assigned to own it, and it is found by scanning rather than by targeting. The harder point is what a compromise leaves behind. Payloads here are configuration: a script, a scheduled job, a user, a firewall rule. RouterOS carries configuration through an upgrade, so replacing the operating system does not evict what was planted in it, and an up to date router can still belong to someone else.

Mechanism. CWE-88, improper neutralization of argument delimiters in a command. The flaw lets an attacker change the trusted RouterOS policy mask, the field that states what a given login is permitted to do. A weaker account widens its own permissions instead of tricking memory: a quoting failure on a command line, not memory corruption. The companion flaw exposes kernel memory and can stall the device through btest, the bandwidth test service.

What to do. Upgrade to 7.24.2, 7.23.4, or 6.49.21. RouterOS inspects itself for compromise during that upgrade and sets a device to Flagged status, recorded as a critical log entry, so here you can ask the device before you patch it. Do that first and read the answer. If it is flagged, the upgrade is containment and not remediation. Follow MikroTik's Flagged recovery, then read the configuration looking for scripts, users, and scheduled jobs you do not recognise, because those survive. Keep SSH off untrusted networks either way.