HIGHVulnerability
Verified
Global

CISA KEV: MikroTik RouterOS — MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation.

Analysis

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation. Added to CISA Known Exploited Vulnerabilities catalog on 2026-09-10. Remediation due: 2026-09-13.

Indicators of Compromise (1)

CVE (1)
CVE-2026-86060
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Sep 10, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerability

Wireshark 4.6.9 Released, (Sun, Sep 27th)

Wireshark release 4.6.9 fixes 19 vulnerabilities and 16 bugs.

SANS ISC
LOWVulnerability

Cloudflare fixes Containers cross-tenant flaw exposing customer data

Cloudflare has fixed a vulnerability in Containers and Sandboxes that allowed customers with a Workers Paid account to recover residual data from other customers' containers on the same physical host. [...]

BleepingComputer
MEDIUMVulnerability

Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks

CISA added CVE-2026-65660 to its KEV catalog, giving federal agencies a patching deadline of September 28. The post Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks appeared first on SecurityWeek .

CVE-2026-65660
SecurityWeek