MikroTik RouterOS — the operating system running on a large share of the world's small ISPs' and businesses' edge routers — had two vulnerabilities added to CISA's Known Exploited Vulnerabilities catalogue on the same day, 10 September 2026, both in low-level connection and authentication handling.
CVE-2026-86060 scores 9.8. Per NVD, it is an argument-handling flaw in the SSH login path: usernames beginning with a prohibited character allow the router's trusted policy mask to be circumvented. CVE-2026-67277 scores 8.2. RouterOS accepts a "related" connection for a bandwidth test (btest) before the primary session it should be tied to has finished authenticating, letting an unauthenticated client start a UDP flood using that unfinished state.
Two ways trust gets granted before it should be
Both bugs share a structural theme worth naming: each is a case of the router extending trust — a policy exemption, a related-connection allowance — based on a check that runs before the thing it depends on is actually verified. CVE-2026-86060's flaw is a string-parsing edge case: a username starting with a character the system is supposed to reject instead causes the router to apply the wrong, more permissive policy mask. CVE-2026-67277's flaw is a sequencing error: connection tracking treats a bandwidth-test session as "related" to a primary session that has not yet completed authentication, and honours it anyway.
Neither requires memory corruption or a sophisticated exploit chain. Both are logic errors in code paths that are, by necessity, reachable before authentication completes — because that is where connection setup and login argument parsing have to live. That is also what makes this category of bug durable: the vulnerable code cannot simply be moved behind an authentication check, because it is the authentication check.
Why RouterOS specifically is worth the attention
MikroTik's install base skews toward small and mid-sized networks — ISPs, branch offices, and organisations running cost-effective routing infrastructure rather than enterprise-grade edge hardware — which correlates strongly with lower patch cadence and less dedicated security monitoring, not with lower actual exposure. An edge router is, definitionally, internet-facing. A pre-authentication bypass at CVSS 9.8 on a device in that position is a serious finding regardless of the size of the organisation running it.
RouterOS devices compromised at scale have historically been assembled into botnets used for further attacks against other targets — a router does not need to hold sensitive data of its own to be a valuable compromise; it needs bandwidth and an IP address the rest of the internet trusts.
The install base is the exposure model
MikroTik's RouterOS runs on hardware chosen specifically for being inexpensive and capable, which is exactly why it shows up disproportionately at the edge of networks with the least dedicated security staffing — regional ISPs provisioning customer-premises equipment, small businesses buying a router once and not revisiting it, branch offices standing up connectivity without central IT involvement. None of that changes the severity of either CVE; it changes the realistic remediation timeline. A CVSS 9.8 pre-authentication bypass sitting on enterprise edge hardware gets a change-managed emergency patch within days. The same bug on a MikroTik router at a regional ISP's customer site may not get attention until an upstream provider or a security researcher specifically flags it, which is part of why RouterOS devices compromised en masse have repeatedly ended up as botnet infrastructure rather than being noticed and remediated individually first.
What to check this week
Patch to a RouterOS version past both CVEs, and verify the version directly rather than assuming an "auto-update" setting caught it — RouterOS deployments frequently run unattended for long periods precisely because they work.
Review SSH access policy on any internet-facing RouterOS device. CVE-2026-86060 specifically defeats a policy mask meant to restrict what a login is permitted to do; confirm what that policy was supposed to enforce and whether it's still doing so post-patch.
Disable or restrict the bandwidth-test service if it isn't actively used for its intended purpose. CVE-2026-67277 requires that feature's connection-tracking behaviour to exist at all; removing exposure to a feature nobody uses is often faster than waiting for a patch cycle.
How Safeguard helps
Safeguard's continuous inventory extends to network and edge infrastructure, not only application-layer software, because — as this pair demonstrates — the devices sitting at a network's boundary carry disproportionate risk relative to how much attention they typically receive. Reachability analysis identifies which edge devices are actually internet-facing and which authentication-adjacent services they expose, so a pre-auth bypass like CVE-2026-86060 is flagged by what it can reach, not left to be discovered only when it already has been.
