Two MikroTik RouterOS CVEs form a credential-free escalation path on edge routers

Two MikroTik RouterOS vulnerabilities entered the US National Vulnerability Database on 5 September 2026, and according to a dev.to analysis the pair matters more together than either flaw alone: one offers unauthenticated reach into a network-facing service, while the other lets a logged-in user escalate to administrative rights.

The two flaws

The higher-scored issue, CVE-2026-86060, carries a CVSS 3.1 base score of 9.8. Per the NVD description cited in the write-up, RouterOS mishandles arguments in its SSH login path when a username begins with a prohibited character. The result is that the trusted RouterOS policy mask, which defines what a session is permitted to do, can be altered, effectively turning a restricted account into an administrative one. The dev.to analysis stresses that this is a parsing failure in the authentication path rather than a memory-safety bug, and that no cryptography is broken and no credential guessed.

The second flaw, CVE-2026-67277, scores 8.2. RouterOS admits a "related" bandwidth-test (btest) connection before the primary session has finished proving its identity. An unauthenticated client can exploit that ordering to start an IPv4 UDP test, and when the test's random-data option is disabled, the device sends out the uninitialised remainder of a kernel packet buffer. The write-up treats the deeper problem as an unauthenticated code path that reaches a network service at all.

Why the pairing matters at the edge

RouterOS frequently sits where an internet connection terminates, handling routing, firewall rules, VPN termination and, in smaller deployments, wireless access. Compromising such a device means controlling the boundary that separates everything behind it from the internet, not just a single system. On its own, the btest flaw is not administrative access. Combined with the escalation bug, the two describe an attacker who reaches the device without credentials and then acquires permissions the login process was supposed to withhold.

How big is the exposure

ZoomEye, as cited in the analysis, indexes 8,083,155 assets fingerprinted as RouterOS, with the figure collected on 16 September 2026. The author is careful about what that number represents: it measures the installed base, not devices running affected versions with SSH or btest reachable from the internet. No estimate of the actually vulnerable population is offered, and the vendor advisory remains the authoritative source for affected version ranges.

What operators should do

The write-up lays out three measures. First, upgrade: MikroTik maintains parallel stable and long-term branches, and operators should confirm the fixed release for their own branch from the vendor advisory rather than trusting a version number from a secondary source. Second, reduce exposure: SSH on port 22 should not be reachable from the internet on an edge router, administrative interfaces belong on a management network or behind a controlled access path, and btest should be disabled unless it is actively used. Third, review accounts and logs: because the escalation flaw alters authorization rather than stealing credentials, an intrusion may leave no failed-login pattern, so the recommended checks are unexpected accounts, sessions from unfamiliar sources, and any account holding permissions broader than its intended role.

Why it matters

Authentication-path bugs in edge devices deserve priority beyond their individual CVSS scores. Neither flaw requires the attacker to hold a credential or defeat cryptography; each abuses an ordering or parsing assumption in code that handles untrusted input, and the affected device is the network boundary itself. The fix is a version upgrade, precisely the change many deployments postpone because an edge router outage is immediately visible to everyone behind it. The dev.to analysis argues that this operational pressure is what makes a scheduled, tested upgrade path worth maintaining before it is needed, alongside keeping SSH and btest off the public internet, since the next flaw of this kind will arrive through the same doors.