Loading vulnerability…
SSH Login Argument Injection in MikroTik RouterOS
CVE-2026-86060 is an argument-injection vulnerability in the MikroTik RouterOS SSH login process. The SSH service passes a client-supplied username to a login helper without rejecting command-option syntax. A username beginning with a hyphen can invoke a legacy mode that reads a trusted identity and policy mask from a specified file descriptor. On vulnerable RouterOS 7.x systems, this descriptor can reference the attacker-controlled session terminal, allowing injection of an administrator identity and full-permission policy mask. The vulnerability provides privilege escalation when an SSH session reaches the login helper. Combined with the SSH authentication-state bypass CVE-2026-67279, it forms the MikroTrick chain, enabling unauthenticated administrative takeover. Exploitation was observed before patches were released.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can grant full administrative control of the affected router, compromising its confidentiality, integrity, and availability. An attacker can change configuration, create privileged accounts, establish persistence through scripts and scheduled tasks, access sensitive configuration data, intercept traffic, and use the router as a foothold into connected networks. The MikroTrick chain enables these outcomes without valid credentials. Updating an already compromised device does not remove existing attacker accounts or persistence.
If you can’t patch tonight, do this now.
Until updates are installed, disable SSH where unnecessary or restrict it to trusted management networks and hosts using firewall rules, an IP allowlist, or a secured VPN. Remove direct Internet exposure and segment the management plane from untrusted networks. Monitor administrative activity and configuration changes. SSH key-only authentication and strong cryptographic settings do not prevent the unauthenticated MikroTrick chain. Temporary access restrictions do not replace patching.
Patch, then assume compromise.
Upgrade to RouterOS 6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable, or a later applicable vendor-supported fixed release. Patched releases validate SSH usernames before invoking the login helper and reject syntax that exposes its trusted-input mode. Investigate previously exposed devices for unauthorized privileged users, scripts, scheduled tasks, tunnels, proxies, and configuration changes. If compromise is suspected, isolate the router, preserve logs and configuration before resetting, rebuild from a verified trusted baseline, and rotate passwords, keys, and other potentially exposed secrets. Do not restore a potentially compromised configuration backup.
5 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
131 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.