CVE-2026-86060

KEV

Updated Sep 11, 2026 · PUBLISHED

Description

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.

Full record on cve.org →

Affected packages

Package	Vendor / Product	Version range	Status
RouterOS	Mikrotik / RouterOS	>= 6.0.0, < 6.49.21	affected
RouterOS	Mikrotik / RouterOS	>= 7.0.0, < 7.23.4	affected
RouterOS	Mikrotik / RouterOS	>= 7.24, < 7.24.2	affected