11 September 2026
Reference: CVE-2026-86060
1. What is being reported?
The vulnerability involves a problem in how MikroTik RouterOS handles certain usernames during SSH login attempts. This flaw can let an attacker change security settings and escalate their access privileges without needing a password, potentially taking over the router.
2. What this means in plain English
If your organisation uses a MikroTik router with the affected software, attackers could remotely gain control of your network device. This could lead to loss of control over your internet connection, interception of data, or further attacks on your systems.
3. Could this affect a small business?
Small businesses, charities, clubs, or any organisation using MikroTik routers running the affected versions of RouterOS could be at risk. If you do not use MikroTik routers or your routers are updated to fixed versions, you are unlikely to be affected.
4. What to do now
- Check if your MikroTik router is running RouterOS version 6.49.21, 7.23.4, 7.24.2 or later, which contain the fix.
- If your router is running an older version, arrange for an immediate update following MikroTik's official instructions.
- If you cannot update immediately, ask your IT provider about available mitigations or consider temporarily disconnecting the router from the internet.
- Review your network for any unusual activity and ensure your IT provider is monitoring for signs of compromise.
5. Ask your IT provider
Can you confirm if our MikroTik routers have been updated to the latest secure RouterOS versions to protect against the CVE-2026-86060 vulnerability?
6. Bottom line
Update your MikroTik routers promptly to prevent attackers from taking control of your network.
Information based on CISA KEV, NVD and reputable security reporting.