Detecting CVE-2026-86060 Exploitation Attempts in MikroTik RouterOS SSH Logs

Vulnerability overview

CVE-2026-86060 is a MikroTik RouterOS privilege escalation vulnerability disclosed by CERT-In on September 16, 2026 in note CIVN-2026-0460. The note rates the RouterOS issues CRITICAL. The flaw is exercised through the RouterOS SSH login path.
Because the exploitation path runs through a logged service, defenders have a detection opportunity alongside the patching task.

Mechanism and exploitation conditions

RouterOS fails to properly handle and neutralize argument delimiters in the SSH login path. An attacker sends a crafted username or command argument through an accessible SSH login session, and the device alters the RouterOS policy mask as a result.
The attacker needs a login session. CERT-In does not describe the flaw as unauthenticated, and no proof-of-concept is published. That means the observable activity happens at authentication and at the login-path argument handling, not in a separate network protocol.

Impact

A successful attack broadens the policy mask on the router, and CERT-In notes the compromised device can be used to reach internal systems. On a routing device, a policy change is both a security event and a configuration change, which is why configuration monitoring and authentication monitoring are complementary here.

Affected products and scope

Affected ranges from CERT-In:

RouterOS 7.24 and versions prior to 7.24.2
RouterOS 7.0.0 and versions prior to 7.23.4
RouterOS 6.0.0 and versions prior to 6.49.21 The note does not publish configuration-specific exceptions. Confirm fixed builds in the MikroTik advisory.

Exposure context

ZoomEye data collected on September 18, 2026 shows the RouterOS footprint. app="MikroTik RouterOS" returned 937,854 assets and os="RouterOS" returned 8,085,082. The CVE filter vul.cve="CVE-2026-86060" returned 0, which is expected for a CVE that has not been indexed by vulnerability.
The counts describe visible RouterOS assets, not confirmed vulnerable devices. For detection planning, they indicate how common the platform is and how much log volume a fleet-wide monitoring rule may generate.

Remediation and mitigations

Patch to a fixed RouterOS release from the MikroTik September 2026 advisory. Alongside patching, add monitoring that fits the exploitation path:

Alert on SSH login usernames that contain delimiter characters or unexpected argument-like substrings.
Baseline the policy mask on management accounts and alert on changes.
Watch for login attempts from new source addresses against RouterOS management interfaces.
Correlate a policy-mask change with a preceding SSH login from an unusual source.
Restrict SSH to trusted management hosts to shrink the log surface you have to watch. The advisory does not publish the exact delimiter sequence, so detection rules should target the general pattern of unusual login-path input rather than a single known string. Review any alert against the device's change history before treating it as an incident.