CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-67277, CVE-2026-86060)
CISA added two actively exploited MikroTik RouterOS vulnerabilities to the KEV Catalog: a missing-authentication flaw and a command-injection flaw, both enabling device takeover. Two MikroTik RouterOS vulnerabilities are under active exploitation: CVE-2026-67277 (missing authentication for a critical function) and CVE-2026-86060 (command argument delimiter injection). Both allow unauthenticated attackers to gain control of affected routers. CISA requires FCEB agencies to remediate per BOD 26-04 and urges all organizations to patch immediately.
Detection / Hunteropenrouter
Immediate Actions
- Patch all MikroTik RouterOS devices to the latest stable firmware immediately.
- Restrict MikroTik management interfaces to trusted internal networks or VPN only.
- Check for signs of prior compromise: unknown admin accounts, unexpected config changes.
- Disable Winbox and API access from untrusted networks if not required.
Key Takeaways
- CVE-2026-67277: Missing authentication for critical function in MikroTik RouterOS.
- CVE-2026-86060: Improper neutralization of argument delimiters enabling command injection.
- Both vulnerabilities are listed in CISA's KEV Catalog with evidence of active exploitation.
- BOD 26-04 mandates FCEB agencies patch KEV-listed CVEs on publicly exposed assets.
- CISA advises all organizations to check for prior compromise before patching.
Attack Chain
- Reconnaissance: Attacker identifies internet-exposed MikroTik RouterOS devices
- Initial Access: Exploit CVE-2026-67277 missing authentication to access critical functions
- Execution: Exploit CVE-2026-86060 command injection to run arbitrary commands on device
- Impact: Attacker gains total control of the router for traffic interception or pivoting
Affected Systems
- MikroTik RouterOS (versions unspecified)
- Federal Civilian Executive Branch agency networks
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-67277 | MikroTik RouterOS | Critical | Missing authentication for critical function allows unauthenticated device takeover. |
| CVE-2026-86060 | MikroTik RouterOS | Critical | Improper neutralization of argument delimiters enables command injection on device. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | Target is network infrastructure (MikroTik routers), not endpoints monitored by EDR. |
| Network Visibility | Medium | Router traffic and management access patterns may be visible via network flow or firewall logs. |
| Detection Difficulty | Hard | Network device exploitation produces limited telemetry compared to endpoint-based attacks. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unauthenticated access to MikroTik RouterOS management interfaces from external IPs indicates exploitation of CVE-2026-67277 (T1190). | Firewall logs, router syslog, netflow data | Initial Access | Low — external unauthenticated access to router management is abnormal. |
| Unexpected command execution or configuration changes on MikroTik devices from non-administrative sources indicate CVE-2026-86060 exploitation (T1059). | Router syslog, configuration change logs | Execution | Medium — legitimate automated management tools may trigger similar patterns. |
Required Log Sources
- MikroTik router syslog
- Network firewall logs
- NetFlow or packet flow data
- VPN or management access logs
Key Behavioral Indicators
- External IP access to MikroTik RouterOS management port without prior authentication
- Unexpected configuration changes or new admin accounts on MikroTik devices
- Anomalous outbound traffic from MikroTik router IP addresses
- Router reboot or service restart events outside maintenance windows
Control Gaps
- Network device logging is often not centralized or forwarded to SIEM
- Router firmware patching is typically manual and infrequent
- Management interface exposure to the internet increases attack surface
False Positive Assessment
Low — unauthenticated external access to router management interfaces and unexpected command execution on network devices are high-confidence indicators of exploitation.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block internet-facing access to MikroTik RouterOS management ports (8291, 8728, 8729).
- Enable MikroTik router syslog forwarding to a centralized logging platform.
- Implement network segmentation to isolate management interfaces from user networks.
User Protection
- Verify VPN configurations on MikroTik routers for unauthorized changes or added users.
- Monitor for anomalous traffic originating from MikroTik router IP addresses.
MITRE ATT&CK Mapping
Initial Access
Execution
Plain-Language Summary
CISA confirmed that attackers are actively exploiting two security flaws in MikroTik router software. One flaw lets attackers bypass login to access critical router functions; the other lets them inject commands into the router. Either flaw can give the attacker full control of the router. Organizations running MikroTik devices should update their firmware immediately and check whether the devices were already compromised.
- cveCVE-2026-67277Missing authentication for critical function allows unauthenticated device takeover.
- cveCVE-2026-86060Improper neutralization of argument delimiters enables command injection on device.