MikroTrick, 7.24, 7.24.2, 7.0.0, 7.23.4, 6.0.0, 6.49.21 - RCE
Affects MikroTik RouterOSSource Exploit-DB RSS Feed
Exploited in the wild · KEV due 13 Sep 2026 · public exploit available (Exploit-DB) · 6% EPSS : apply the vendor's fix or mitigations to MikroTik RouterOS now.
Data as of 10/25/2026, 04:40:14 UTC
- Exploitation
Actively exploited – in CISA KEV since 09/10/2026
- KEV deadline
- 09/13/2026 US federal agencies must patch by this date; a sensible deadline for everyone else.
- EPSS
- 6.3% chance of exploitation in 30 days – higher than 93% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Public exploits
- 1 Exploit-DB entryPublic attack or detection tooling exists; see Public exploits below.
What to do
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- mikrotik.com/supportsec/september-2026-vulnerability (opens in a new tab)
- cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (opens in a new tab)
- cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk (opens in a new tab)
- nvd.nist.gov/vuln/detail/CVE-2026-86060 (opens in a new tab)
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| MikroTik RouterOS | Affected
| Fixed in
|
Public exploits and detection
Exploit-DB
Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.
Description
A remote code execution (RCE) vulnerability identified as CVE-2026-86060 affects MikroTik RouterOS versions 7.0 up to but not including 7.23.4, and versions 7.24.0 up to but not including 7.24.2. Exploit code leveraging this vulnerability is publicly available, involving MikroTik CHR 7.23.3 (x86_64) and Python3-paramiko on Kali Linux 2025.x. No official patch or vendor advisory details are provided.
Impact
Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely on affected MikroTik RouterOS devices. This can lead to full system compromise, unauthorized access, and potential disruption of network operations. The availability of exploit code increases the risk of exploitation, although no known active exploitation in the wild is reported.
Mitigation
Restrict access to affected MikroTik devices, especially from untrusted networks, and monitor for suspicious activity related to this vulnerability.
Weaknesses
- CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (opens in a new tab)
Base weaknessOWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Indicators of compromise
Exploit source code
#!/usr/bin/env python3
#
# Exploit Title: MikroTik RouterOS <= 7.23.3 - Unauthenticated SSH Session Policy-Mask Swap (Full Admin)
# Date: 2026-09-17
# Exploit Author: DigiProSec
# Vendor Homepage: https://mikrotik.com
# Software Link: https://mikrotik.com/download
# Version: RouterOS < 6.49.21, 7.0 < 7.23.4, 7.24.0 < 7.24.2 (fixed in 6.49.21 / 7.23.4 / 7.24.2)
# Tested on: MikroTik CHR 7.23.3 (x86_64), Kali Linux 2025.x, python3-paramiko
# CVE: CVE-2026-86060
#
# CVE-2026-86060 — Unauthenticated…