MikroTik RouterOS Under Active Attack (CVE-2026-86060): When There's No CVSS Score to Wait For
MikroTik RouterOS is being actively exploited, and CVE-2026-86060 is in the CISA KEV catalog. Here is the interesting part for anyone who prioritizes by severity score: at the time of writing, this CVE has no CVSS score. NVD has not analyzed it yet. If your triage process starts with "what's the CVSS," this one falls through the cracks while attackers are already using it. That gap is exactly what SSVC is built to close. What the vulnerability is CVE-2026-86060 is a privilege escalation flaw
MikroTik RouterOS is being actively exploited, and CVE-2026-86060 is in the CISA KEV catalog. Here is the interesting part for anyone who prioritizes by severity score: at the time of writing, this CVE has no CVSS score. NVD has not analyzed it yet. If your triage process starts with "what's the CVSS," this one falls through the cracks while attackers are already using it. That gap is exactly what SSVC is built to close.
What the vulnerability is
CVE-2026-86060 is a privilege escalation flaw in how RouterOS handled SSH usernames beginning with a disallowed character. A crafted username returns a session with full administrative privileges. The weakness class is CWE-88, improper neutralization of argument delimiters. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.
On its own that is serious. Chained with a second flaw, it is worse. CERT Polska, Poland's national CSIRT, found six RouterOS vulnerabilities and named the key exploit chain MikroTrick. CVE-2026-86060 combines with an SSH authentication bypass (CVE-2026-67276, where RouterOS compared only the public modulus of an RSA key rather than the whole key) to give an attacker full control of any device with SSH reachable from the internet, no valid credentials needed. CERT Polska confirmed active exploitation and that the patches stop the observed attacks.
The exposure is large. Shadowserver counted more than 122,000 MikroTik devices with SSH reachable from the internet in a single 24-hour scan.
Why SSVC matters here more than CVSS
CVSS measures how severe a flaw is in the abstract. SSVC (Stakeholder-Specific Vulnerability Categorization) measures something different and more actionable: how urgently you should act, given what is actually happening in the world. For CVE-2026-86060, the SSVC signals are unambiguous. Exploitation is Active. The attack is Automatable. The impact is Total.
Those three signals tell you to move now, and they are available even though the CVSS field is still blank. That is the whole point. A missing or delayed CVSS score is common for fresh CVEs, and it is precisely when a vulnerability is newest, and least analyzed, that active exploitation is most dangerous. Waiting for a severity number to populate is waiting for the wrong signal. KEV membership and SSVC tell you what CVSS cannot yet.
Who is affected and what to do
MikroTik released fixes in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Update immediately. CERT Polska and MikroTik both recommend patching over any temporary measure.
If you cannot patch right away, restrict or disable exposed services, SSH, WWW/WWW-SSL, and the bandwidth-test server, or limit them to trusted management networks. Treat these as stopgaps, not fixes.
Because this is under active exploitation, also check for compromise. Look for an unexplained highly privileged user named "ops," review your configuration for unknown scripts or users, and check the flagged-state marker that patched RouterOS versions set when they detect suspicious changes at startup. A clean flagged state does not guarantee safety, so inspect the config regardless.
Reading it on VulnTracker
The CVE-2026-86060 page in VulnTracker is a good example of why a single score isn't the whole story. The CVSS field reads N/A, because NVD hasn't scored it, but the page still gives you everything you need to act: an Actively Exploited flag tied to CISA KEV, an SSVC panel showing Active, Automatable, and Total impact, and the KEV remediation-due date so the deadline is visible. The Affected Products section lists the vulnerable RouterOS versions with a Track button for future MikroTik CVEs.
The decision doesn't wait on a CVSS number. Is RouterOS in your stack, is SSH exposed, and is it patched. Those three answers are enough.
The takeaway
Severity scores are useful, but they are slow and sometimes absent, and attackers do not wait for NVD. Prioritizing by real-world signals, active exploitation, KEV membership, SSVC, catches the vulnerabilities that a CVSS-first process misses at exactly the moment they matter most.
Track CVE-2026-86060 and your MikroTik versions at vulntracker.io
References: CERT Polska · MikroTik security bulletin · CISA KEV
Related reading
Redis TLS Use-After-Free (CVE-2026-81934): A Case Study in Reading Severity Correctly
CVE-2026-81934 is a use-after-free in Redis that was first published as a CVSS 9.8 Critical, then reassessed down to High once the real exploitation conditions were weighed. It's a clean lesson in why the number on a CVE is a starting point, not the answer.
Metabase Pre-Auth SQL Injection (CVE-2026-72898): CVSS 10.0, Actively Exploited
CVE-2026-72898 is an unauthenticated SQL injection in Metabase, scored CVSS 10.0 and already in CISA KEV. One request to /api/session/reset_password gives an attacker admin access and the credentials for every connected database. If you run Metabase, patch today.
PostgreSQL to_char Heap Buffer Overflow (CVE-2026-14669): What It Is and How to Read It Fast
CVE-2026-14669 is a CVSS 8.8 HIGH heap buffer overflow in PostgreSQL's to_char function that can run arbitrary code as the database OS user, patched August 13, 2026. Two questions decide your workload: is Postgres in your stack, and is your version older than 18.5 / 17.11 / 16.15 / 15.19 / 14.24?