LOWVulnerability

CVE-2026-86060

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation.

Properties

product
RouterOS
vulnerabilityName
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
epss_score
0.00401
cve_id
CVE-2026-86060
dueDate
2026-09-13
vendorProject
MikroTik
requiredAction
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discon
dateAdded
2026-09-10
epss_percentile
0.33627

Related Entities (3)

DESCRIBES (1)

[KEVEntry]MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

ENRICHED_BY (1)

[Source]FIRST EPSS

KNOWN_EXPLOITED (1)

[Source]CISA KEV

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-86060 — Ninja Signal Threat Intelligence | Ninja Signal