CVE-2026-86060

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 (Long-term) RouterOS versions prior to 7.23.4 (Long-term) RouterOS versions prior to 7.24.2 (Stable)

Description An argument-handling flaw exists in the SSH login path. By using a username that begins with a prohibited character, an unauthenticated attacker can reach the RouterOS login helper and modify the trusted RouterOS policy mask. This improper neutralization of argument delimiters allows for privilege escalation, potentially granting administrative access without credentials.

Recommendations Update to version 6.49.21 (Long-term). Update to version 7.23.4 (Long-term). Update to version 7.24.2 (Stable).