CVE-2026-86060: Privilege Escalation in MikroTik RouterOS via Argument Injection

An argument injection flaw in MikroTik RouterOS, tracked as CVE-2026-86060, allows an attacker to manipulate internal command execution routines and alter the system’s trusted policy mask. By exploiting improper neutralization of argument delimiters, restricted callers or low-privilege users can bypass assigned permission boundaries to elevate privileges across the network appliance.

Mechanics of Policy Mask Tampering

MikroTik RouterOS relies on a granular permission model—known as policy masks—to govern what specific operations a given user, API session, or script can perform (such as read, write, reboot, policy, or sensitive). Under normal operating conditions, a restricted operator account cannot execute administrative commands outside its assigned group policies.

CVE-2026-86060 stems from an argument injection flaw (CWE-88) in how RouterOS sanitizes input prior to passing parameters to internal utilities. When malicious input containing unneutralized argument delimiters (such as unescaped spaces, quotes, or flag characters) is submitted through an interactive CLI session or API call, the system fails to isolate the input as a single data parameter.

This oversight allows an attacker to append arbitrary command-line flags to internal calls. By tricking the parser into evaluating injected arguments, the attacker can force the system to overwrite the current session’s effective policy mask, turning a low-privilege shell into a full administrative account with broad system access.

Risk Context and Threat Exposure

EPSS currently places the 30-day probability of exploitation at 0.40% (33.6th percentile), indicating that wide-scale automated exploitation has not yet dominated public telemetry. However, argument injection flaws on perimeter routing platforms represent a severe risk in real-world exploit chains.

MikroTik hardware is widely deployed across enterprise edge networks, Wireless ISPs, and small-to-medium businesses. Historically, threat groups—ranging from botnet operators recruiting proxy networks to state-sponsored actors establishing persistent infrastructure access—frequently target RouterOS devices. While CVE-2026-86060 requires an initial context to send command parameters, it serves as a high-value privilege escalation vector. An attacker who gains low-privilege access via weak credentials, misconfigured API scripts, or a minor initial-access vulnerability can leverage this flaw to seize control of the underlying OS, rewrite routing tables, inspect transit traffic, or establish persistence across reboot cycles.

Remediation and Mitigation

Organizations operating RouterOS devices should prioritize software updates and access controls to mitigate exposure:

• Apply Vendor Software Updates: Update all RouterOS instances to patched software releases following MikroTik’s deployment instructions.
• Enforce Access Segmentation: Isolate management endpoints (WinBox, WebFig, SSH, REST API) from the public internet. Use /ip service constraints and /ip firewall filter rules to limit management access strictly to trusted management subnets.
• Audit User Permissions: Review local user accounts, API keys, and automated script privileges to ensure no unauthorized access points exist.
• Compliance Compliance: Entities operating under CISA BOD 26-04 requirements must complete vendor-directed remediations or disconnect vulnerable, internet-exposed instances prior to the September 13, 2026 deadline.