Two MikroTik RouterOS flaws chain together, an argument injection in the login process plus a second flaw, to give an unauthenticated attacker administrative access to the router. Both are exploited and in CISA KEV. The router is the device every other device trusts, so this is a control-plane compromise. Upgrade RouterOS, restrict the management plane, and prove it from outside.
SEVERITY
Critical (chained)
PEAK CVSS
n/a
AUTH REQUIRED
None (chain)
PUBLIC POC
Reported
PUBLISHED
Nov 4, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
Own the router and you do not need to breach anything else. You already decide what every device behind it can see, where traffic goes, and what the network believes is normal.
This RouterOS chain gets an attacker there without a password. An argument injection in the login process (CVE-2026-86060) combines with a second RouterOS flaw (CVE-2026-67279) to produce unauthenticated administrative access to the device itself. From the admin plane an attacker can reroute traffic, add accounts, disable logging, and sit quietly in the path.
MikroTik gear is everywhere, from small offices to ISPs, and it has a long history of being mass-exploited and conscripted into botnets, precisely because so many units sit on the internet with old firmware and default-ish management exposure. CISA listing both halves of the chain is the signal that this is in active use now. Routers rarely get the patch urgency of servers, yet a compromised one undermines every control that sits behind it. The two questions that matter: is RouterOS current, and can anyone outside reach the management plane at all.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking an exploited MikroTik RouterOS chain. An argument injection in the login process (CVE-2026-86060) combines with a second RouterOS flaw (CVE-2026-67279) to grant unauthenticated administrative access to the router. Both are in CISA KEV. RouterOS devices are widely deployed and have a long history of mass exploitation and botnet conscription. The control is current RouterOS plus a management plane that untrusted networks cannot reach, proven from outside.
KEY JUDGMENTS
01
CISA added CVE-2026-86060 to KEV on Sep 11, 2026 and CVE-2026-67279 subsequently, citing active exploitation of the chain for unauthenticated administrative access.Observed
02
Administrative access to a router is a control-plane compromise: traffic rerouting, account creation, logging tampering and persistence in the network path.Assessed
03
The chain couples an argument injection in the login process with a second flaw, so neither a password nor user interaction is required.Reproduced
04
RouterOS devices span small offices to ISPs and are frequently internet-exposed on old firmware, which is why they are a recurring mass-exploitation and botnet target.Assessed
CVE-2026-86060, argument injection in the login process
Component
MikroTik RouterOS
Chained outcome
Unauthenticated administrative access to the device
Vector
Network, against the RouterOS management services
Affected
RouterOS below the fixed release (confirm the branch in MikroTik’s advisory)
Scoring
Confirm per-CVE scores in NVD; critical in combination
Impact
Full administrative control of the router.
EXPOSURE: ROUTEROS, MANAGEMENT PLANE REACHABLE
01RouterOS below the fixFirmware not yet on the fixed release.
02Management reachableWinbox, API, SSH or HTTP reachable by an attacker.
03Internet-facingEdge routers on old firmware are the priority.
04Flat trustEverything behind the router trusts it by default.
03 · THREAT ACTIVITY
Exploitation status and timeline
IN THE WILDObservedChain exploited; both CVEs in KEV.
OUTCOMEUnauth adminAdministrative access, no login.
HISTORYBotnet targetLong record of mass exploitation.
PATCHAvailableFixed RouterOS release.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Sep 11CISA adds CVE-2026-86060, the RouterOS login argument injection, to KEV.
LaterCVE-2026-67279 is added to KEV; reporting describes the two chained for unauthenticated administrative access.
ContextRouterOS has a long history of mass exploitation and botnet conscription when management services are exposed on outdated firmware.
04 · AFFECTED PRODUCTS
Affected and fixed versions
Exposure is any RouterOS device below the fixed release with a reachable management plane. Confirm the exact affected branches and fixed release against MikroTik’s advisory.
ITEM
AFFECTED
FIXED IN
STATUS
MikroTik RouterOS
below the fixed release
fixed RouterOS release per advisory
Fixed
Internet-facing RouterOS
management plane exposed
upgrade and restrict management
Priority
Branch / edge RouterOS on old firmware
rarely updated
find and upgrade
Higher risk
RouterOS on the fixed release
management restricted
not affected
Fixed
CONFIRM THE BRANCHMikroTik ships long-term and stable RouterOS branches. Confirm the affected versions and the fixed release for your branch against MikroTik’s advisory before scheduling the upgrade.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Internet-facing RouterOSUpgrade to the fixed release and remove the management plane from untrusted networks now.
Any router with exposed managementRestrict Winbox, API, SSH and HTTP to trusted sources immediately.
HighWithin 72 hours
All RouterOS devicesUpgrade firmware, including branch and small-office routers on old versions.
Compromise reviewOn exposed devices, review admin accounts, scripts, scheduler tasks and firewall/NAT rules for tampering.
CredentialsRotate router credentials and keys after upgrading an exposed device.
HighBefore closing
Every deviceRecord the RouterOS version, management reachability and the review result as evidence.
WORKAROUNDS
Restrict the management plane. Limit Winbox, API, SSH and HTTP to trusted management networks; drop them from the internet.Upgrade RouterOS. Apply the fixed release for your branch. Firmware is the durable fix.Review after exposure. Check admin users, scripts, scheduler and firewall/NAT rules for unauthorized changes.Rotate credentials. Change router passwords and keys once an exposed device is upgraded.
06 · DETECTION AND HUNTING
Observables and hunting queries
A compromised router is changed from within, so hunt on management-plane exposure and on unauthorized configuration changes.
TYPE
OBSERVABLE
SOURCE
Exposure
RouterOS management services reachable from the internet
External scan, edge config
Behavior
New admin users, scripts or scheduler tasks on the device
RouterOS config review, logs
Behavior
Unexpected firewall, NAT or routing changes, or disabled logging
RouterOS config and log review
EXPOSURE · RouterOS chainmanagement reachability
# in scope: probe Winbox/API/SSH/HTTP from an external vantage
The chain couples two RouterOS weaknesses. CVE-2026-86060 is an argument injection in the RouterOS login process: crafted input is passed into a command in a way that lets an attacker influence how the login logic runs. Combined with CVE-2026-67279, the pair yields unauthenticated administrative access to the device, meaning an attacker reaches the router’s admin plane without valid credentials or user interaction. Both halves are reachable through the RouterOS management services.
Administrative access to a router is not a single-host compromise, it is control of the path. From the admin plane an attacker can reroute or mirror traffic, add persistent accounts and scripts, alter firewall and NAT rules, and disable logging to stay hidden. MikroTik devices are deployed from home offices to ISP cores and have repeatedly been mass-exploited and pulled into botnets when management services sit on the internet with outdated firmware. CISA listing both CVEs is the signal that this chain is in active use, and the response is firmware plus a management plane that untrusted networks simply cannot reach.
01 REACH
Attacker reaches the RouterOS management services
Control: Restrict management to trusted networks
02 INJECT
Argument injection in the login process
Control: Upgrade RouterOS to the fixed release
03 CHAIN
Second flaw completes the bypass
Control: Rotate credentials after exposure
04 ADMIN
Unauthenticated administrative access to the router
Control: Review config for tampering and persistence
RouterOS login argument injection, added to CISA KEV on Sep 11, 2026.
AssessedThe router is the device every other control trusts. Unauthenticated admin access to it undermines everything behind it, so firmware currency and management-plane isolation are not optional.
09 · VALIDATION
Confirm remediation
A firmware version alone is not a verdict after a control-plane compromise risk. Each device should end with evidence: on the fixed release, management unreachable from untrusted networks, and config reviewed.
01
Inventory RouterOS devices and versions
Include branch, small-office and ISP-edge routers.
# collect RouterOS version per device (e.g. /system resource print)
02
Confirm the fixed release
Compare each version against MikroTik’s fixed release for the branch.
# compare RouterOS version to the MikroTik advisory fixed release
03
Test management reachability
From outside, confirm Winbox, API, SSH and HTTP are not internet-reachable.
# in scope: probe the management services from an external vantage point
04
Review the configuration
Check for unauthorized admin users, scripts, scheduler tasks and rule changes.
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is this RouterOS chain being exploited?
Yes. CISA added CVE-2026-86060 to KEV on September 11, 2026 and CVE-2026-67279 subsequently, citing active exploitation of the chain for unauthenticated administrative access.
What does the chain achieve?
Unauthenticated administrative access to the router, which means control of the control plane: traffic rerouting, account creation, logging tampering and persistence.
Which versions are affected?
RouterOS below the fixed release for your branch. Confirm the exact affected versions and fixed release against MikroTik’s advisory.
What is the fastest risk reduction?
Remove the management plane from untrusted networks immediately, then upgrade RouterOS and rotate credentials on any exposed device.
VALIDATE YOUR EXPOSURE
Prove your router control plane
Hayrok inventories your RouterOS devices, confirms firmware against the fixed release, and tests whether the management plane is reachable from untrusted networks. Every result lands in Evidence Fabric.