KEV Entry

CVE-2026-86060

Known Exploited Vulnerability Entry ENISA

Back to Catalog View Vulnerability
Entry Details
Confirmed Exploited

CVE-2026-86060

2026-09-05 02:00 CEST

Timestamps

2026-09-05

2026-09-05

Scope

MikroTrick | Affected: MikroTik / RouterOS | Description: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable) | Patched since: 2026/09/03 | Exploitation type: unknown | CWEs: CWE-88 | Origin source: CERT.PL | Notes: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/

References
  • {'id': 'CVE-2026-86060', 'url': 'https://www.cve.org/CVERecord?id=CVE-2026-86060'}
  • {'id': 'EUVD-2026-72029', 'url': 'https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72029'}
  • {'id': 'source', 'url': 'https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/'}

9e9a2427-13ee-42cf-9088-254bd7a706d1

ENISA
cce329bf-df49-4c6e-a027-80be2e6483bd

2026-10-02 08:52 CEST

2026-10-02 08:52 CEST

Evidence
1
Type Source Signal Confidence Details GCVE Metadata
csirt_report enisa-cnw-kev successful_exploitation 0.75
View details 
{
  "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON",
  "cwes": [
    "CWE-88"
  ],
  "dateReported": "2026/09/05",
  "euvd": "EUVD-2026-72029",
  "exploitationType": [
    "unknown"
  ],
  "notes": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/",
  "originSource": "CERT.PL",
  "patchedSince": "2026/09/03",
  "product": "RouterOS",
  "threatActorsExploiting": [],
  "vendorProject": "MikroTik",
  "vulnerabilityName": "MikroTrick"
}
 -
Export Options
JSON Object JSON API View Full Catalog