Two MikroTik RouterOS flaws chain into pre-authentication remote code execution
On September 10, 2026, CISA added two MikroTik RouterOS flaws — a missing authentication check and a command injection — to its KEV catalog after active exploitation. The chain yields remote code execution with no credentials, and the federal remediation deadline lands on September 13.
September 10, 2026. CISA added two MikroTik RouterOS vulnerabilities to its KEV catalog of actively exploited flaws. The first, CVE-2026-67277, is a missing authentication check on a critical function (CWE-306) — an unauthenticated client can reach the btest service before the primary session completes authentication, opening the door to kernel memory disclosure and a possible system restart. The second, CVE-2026-86060, is improper neutralization of argument delimiters (CWE-88), in other words a command injection. Chained together, they deliver what every botnet operator looks for: remote code execution with no credentials on an edge router.
The window is already open. MikroTik has published fixes — RouterOS 6.49.21, 7.23.4 and 7.24.2 — but federal directive BOD 26-04 requires US agencies to remediate by September 13, 2026, the KEV due date for these flaws. For a private organization, that is the same de facto SLA: active exploitation means the dwell-time clock started before you read this.
Two flaws, one code-execution chain
RouterOS runs on RouterBOARD hardware, CHR virtual appliances, and x86 installs. Its exposure surface is broad because several services are routinely reachable from untrusted networks: the WebFig web interface (TCP 80/443), Winbox (TCP 8291), the API (TCP 8728/8729), SSH (TCP 22), and FTP (TCP 21).
CVE-2026-67277 is the access half: a component exposes a critical function without enforcing authentication. Concretely, the btest service accepts a “related” connection before the primary session has finished authenticating — a gap that lets an attacker reach privileged functionality without credentials. CVE-2026-86060 is the payload half: RouterOS fails to sanitize argument delimiters before passing user input to a command-execution context. By injecting a delimiter, the attacker escapes the intended argument scope and appends their own commands.
The likely attack chain is mechanical: scan for exposed RouterOS services (fingerprintable via banner, TLS certificate, or HTTP response signatures), use CVE-2026-67277 to reach the vulnerable function, then inject through CVE-2026-86060 to run OS-level commands. All without ever supplying a password.
What the chain gives an attacker
Once the router is compromised, RouterOS post-exploitation is well documented: adding hidden admin accounts, persistence through the script and scheduler engine (/system script, /system scheduler), editing firewall and NAT rules to redirect traffic, standing up SOCKS proxies or tunnels, and intercepting transit traffic. A compromised edge router becomes a pivot: it sees DNS, internal traffic, and downstream segments.
That is what makes this serious beyond the severity score. RouterOS has a long history of mass exploitation by botnets — most notably Mēris in 2021, which pooled hundreds of thousands of boxes for DDoS attacks — and by state-aligned actors. MikroTik devices are frequently internet-exposed, rarely monitored, and almost never onboarded into an EDR: an ideal target for cheap initial access.
The KEV and the September 13 deadline
A KEV listing is not a casual signal: CISA only adds a flaw with credible evidence of in-the-wild exploitation. Both CVEs are therefore already in use, not merely “exploitable”. Directive BOD 26-04 requires Federal Civilian Executive Branch (FCEB) agencies to remediate by the catalog due date — September 13, 2026 for these two. The private sector is not bound by the directive, but it should adopt the deadline as its own internal SLA: under active exploitation, the CVSS score is secondary, the priority comes from the field.
Patching is not enough: hunt the compromise
Because a router cannot run an EDR agent, detection rests on log and network telemetry. Forward RouterOS syslog to your SIEM (at minimum the system, critical, and firewall topics) and watch the management plane. Observables to look for:
- unauthenticated or anomalous requests to web/API endpoints containing shell metacharacters (
;,|,&&,$(), or backticks); - new or unexpected local user accounts;
- scheduler entries or scripts you did not create — the classic persistence mechanism;
- out-of-window configuration changes: new NAT rules, enabled SOCKS service, modified DNS;
- outbound connections from the router to unfamiliar external IPs.
A check before and after remediation:
/system scheduler print
/system script print
/user print
/ip firewall nat printPatching does not evict an attacker. If you confirm a compromise, treat the device as fully untrusted: export and review the configuration, re-image it (netinstall), rotate all credentials — including those of downstream systems the router could observe — and review traffic logs for interception or redirection.
Verdict
If you run RouterOS at the edge or for MSP/MSSP customers, treat this chain as an emergency change request, not a routine patch cycle: move immediately to 6.49.21, 7.23.4, or 7.24.2 for your branch, disable unused services (FTP, Telnet, the API if Winbox/SSH suffice), and audit the device before and after patching. If an end-of-life RouterOS train will not receive a fix, replace the hardware — no configuration rule will make it safe.
If you run a heterogeneous estate without a network inventory, now is the moment to run an inventory scan of ports 8291, 8728, and 8729: the exposed boxes you find are very likely already under pressure. The CVE-2026-67277 + CVE-2026-86060 chain requires no zero-day and no user interaction — only network reachability. That is the definition of a risk to fix before the end of the day.