CVE-2026-86060

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2

Description An argument-handling flaw exists in the SSH login path when usernames begin with a prohibited character. This allows an unauthenticated user to reach the RouterOS login helper and change the trusted RouterOS policy mask, resulting in privilege escalation.

Recommendations Update to version 6.49.21 or later for the Long-term release. Update to version 7.23.4 or later for the Long-term release. Update to version 7.24.2 or later for the Stable release.