CVE-2026-86060

SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

En bref

Sévérité: CRITICAL 9.2
Exploitation: Exploitation connue (CISA KEV) · ajoutée le 2026-09-10
Exploitée selon l'ENISA depuis le 2026-09-05
EPSS: EPSS 6.39 % · centile 94 (2026-10-27)
État: PUBLISHED
Publiée: 2026-09-05
Mise à jour: 2026-09-11
Attribuée par: CERT-PL
Statut NVD: Analyzed

Description

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	CRITICAL 9.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	CERT-PL
CVSS 4.0	CRITICAL 9.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · cvd@cert.pl (Secondary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-88

Références européennes

ENISA EUVD · EUVD-2026-72029
GCVE · GCVE-0-2026-86060

Configurations affectées (CPE NVD)

cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:* ≥ 6.0 < 6.49.21
cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:* ≥ 7.0 < 7.23.4
cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:* ≥ 7.24 < 7.24.2

Produits affectés

Produit	Versions
Mikrotik · RouterOS	affected 7.24 < 7.24.2 ; affected 7.0.0 < 7.23.4 ; affected 6.0.0 < 6.49.21

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD