CISA Adds Exploited MikroTik RouterOS Flaws to Security Alert
CISA added two actively exploited MikroTik RouterOS flaws, CVE-2026-67277 and CVE-2026-86060, to its KEV catalog with a September 13 mitigation deadline.
CISA added CVE-2026-67277 and CVE-2026-86060 in MikroTik RouterOS to the Known Exploited Vulnerabilities catalog on September 10, giving federal agencies until September 13 to apply vendor mitigations. CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the bandwidth-test (btest) service that can expose kernel memory and cause denial of service; CVE-2026-86060 (CWE-88) lets attackers manipulate the trusted RouterOS policy mask for privilege escalation. CISA designated CVE-2026-86060 as requiring forensic triage under Binding Operational Directive 26-04, meaning organizations should hunt for compromise indicators, not just patch. Compromised routers could have altered routing rules, persistence, traffic interception, or use as pivots into internal networks.
- CVE-2026-67277 exposes kernel memory via the unauthenticated btest service
- CVE-2026-86060 enables RouterOS policy-mask tampering and privilege escalation
- Federal agencies face a September 13 remediation deadline under KEV rules
- CISA mandates forensic triage of CVE-2026-86060 for compromise indicators
- Defenders should restrict btest exposure and review router logs for tampering
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1040 Network Sniffing
- Tags
- active-exploitationcisadenial-of-servicekevmikrotiknetwork-appliancesprivilege-escalationrouteros
- Products
- RouterOS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86060+1 related CVE | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 group max | 6% | KEVPoC ×3 | KEV |
From the original article
2 min read at gbhackers.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities in MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, warning that these flaws are actively being exploited in the wild.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.