Source: cisa.gov
CVE-2026-86060 is a vulnerability in MikroTik RouterOS involving improper neutralization of argument delimiters in a command. The flaw allows an attacker to manipulate the trusted RouterOS policy mask, resulting in privilege escalation. It has been flagged by CISA under BOD 26-04, which prioritizes security updates based on risk. Federal agencies and organizations using MikroTik RouterOS are advised to apply patches promptly. The vulnerability is tracked in the NVD and CISA's Known Exploited Vulnerabilities catalog. Forensics triage requirements are outlined in CISA's BOD 26-04 implementation guidance. The issue poses significant risk to network infrastructure environments relying on RouterOS.
