PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← Back | CVE Intelligence Hub

CVE-2026-86060[Critical][Actively exploited]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-86060.

Vendor
MikroTik
Product
RouterOS
Affected versions
[7.24, 7.24.2), [7.0.0, 7.23.4), [6.0.0, 6.49.21)
CVSS
9.2
Exploit Status
Actively exploited
Coverage Span
2026-09-22
Reports
1 related reports

Associated Reports & Timeline

1.
MicroTrick: MikroTik RouterOS Unauthenticated Takeover Exploit PoC (CVE-2026-86060)
github.com | vulnerability | Critical | [Actively exploited] | | Original ↗ | .md | #active-exploitation | #rce | #zero-day | #authentication-bypass
MicroTrick provides a standalone Python exploit for the MikroTik RouterOS attack chain (CVE-2026-86060, CVE-2026-67279), which has been actively exploited in the wild and cataloged by CISA KEV. By chaining an SSH pre-auth key rekeying authentication bypass with an SSH helper defect that parses negative usernames as file descriptors to replace the policy mask, an unauthenticated attacker can gain full administrator privileges over SSH. Patched across RouterOS branches (7.24.2, 7.23.4, 6.49.21).
Why it matters: MikroTik routers form critical edge infrastructure worldwide; with confirmed active exploitation in the wild and public PoC code available, unpatched edge devices face immediate risk of remote takeover.