HIGHVulnerability
Verified
Global

CISA KEV: MikroTik RouterOS — Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.

Analysis

Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. Added to CISA Known Exploited Vulnerabilities catalog on 2026-09-25. Remediation due: 2026-09-28.

Indicators of Compromise (2)

CVE (2)
CVE-2026-86060
NVDMITRE CVE
CVE-2026-67279
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Sep 25, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerability

Capitolis agrees $200m eSecLending acquisition

Capital markets technology provider Capitolis has added securities lending capabilities to its platform through a $200 million all-cash deal to buy eSecLending.

Finextra
MEDIUMVulnerability

Citi launches multi-market instant payments on Swift scheme

Citi has gone live with multiple markets on the Swift payments scheme, enabling bank clients to access multiple cross-border instant payment markets through a single account structure.

Finextra
MEDIUMVulnerability

Zilch eyes 2027 London IPO

Zilch is in talks with banks as it prepares to go public, with the UK-based buy now, pay later provider reportedly leaning towards a London listing.

Finextra