DEV Community

jeffrey
jeffrey

Posted on

Two RouterOS Bugs, One Escalation Path: What CVE-2026-67277 and CVE-2026-86060 Mean for Edge Routers

#security #routers #mikrotik #authentication

Two RouterOS Bugs, One Escalation Path: What CVE-2026-67277 and CVE-2026-86060 Mean for Edge Routers

MikroTik RouterOS runs on a large share of the internet's edge. Two vulnerabilities published to the National Vulnerability Database on 2026-09-05 illustrate how authentication gaps in that position compound, and why the fix is a version upgrade plus an exposure decision.

The two flaws

CVE-2026-86060 carries a CVSS 3.1 base score of 9.8. The NVD description states that RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing the trusted RouterOS policy mask to be changed, which leads to privilege escalation. The flaw is not a memory-safety bug. It is a parsing failure in the authentication path, and the consequence is a change to the authorization policy the device applies to the session.
CVE-2026-67277 carries a CVSS 3.1 base score of 8.2. The NVD description states that RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test; with "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. The btest facility is MikroTik's bandwidth-testing service, and the flaw is that a secondary connection is admitted on the basis of a primary session that has not yet proven itself.
Both descriptions share a structural characteristic. Neither requires the attacker to break cryptography or guess a credential. Each exploits an ordering or parsing assumption in code that handles unauthenticated input.

Why this matters on an edge device

RouterOS is frequently the device that terminates an internet connection. It handles routing, firewall rules, VPN termination, and in many small and mid-sized deployments, wireless access as well. Administrative control of that device is not a single-system compromise. It is control of the boundary that separates everything behind it from the internet.
The privilege escalation in CVE-2026-86060 is specifically about the policy mask, which governs what an authenticated session is permitted to do. An attacker who can alter that mask can grant themselves capabilities the login process was supposed to withhold. The practical effect is that a low-privilege or restricted account becomes an administrative one.
The btest issue in CVE-2026-67277 is narrower in isolation. An unauthenticated UDP test session is not by itself administrative access. Its significance lies in what it demonstrates: an unauthenticated code path that reaches a network-facing service. Combined with the escalation flaw, the pair describes an attacker who can reach the device without credentials and then act with permissions they should not hold.

The exposure question

RouterOS is widely deployed, and the relevant question is how much of it is reachable from the internet. ZoomEye indexes 8,083,155 assets matching os="RouterOS". That figure describes devices whose operating system fingerprint is RouterOS, not devices running a vulnerable version, and not devices with SSH or btest exposed to the internet.
The distinction matters because the mitigations for these two CVEs are different in kind. CVE-2026-86060 is fixed by upgrading. CVE-2026-67277 is also fixed by upgrading, but the exposure of the btest service and the SSH service is a configuration decision that remains relevant even after patching, because the next authentication-path flaw will be reachable through the same door.

Remediation

Vendor guidance directs operators to upgrade to a fixed release on their maintenance branch. MikroTik maintains parallel stable and long-term branches, and the correct target version depends on which branch a deployment follows. Operators should confirm the fixed version from the vendor advisory for their branch rather than applying a version number from a secondary source.
Exposure reduction is the second measure and should not be treated as optional. SSH on port 22 should not be reachable from the internet on an edge router. Administrative interfaces belong on a management network or behind a controlled access path. The btest service should be disabled unless it is actively in use, and it should never be reachable from an untrusted network.
Credential and log review is the third measure. Because CVE-2026-86060 involves the policy mask rather than credential theft, an intrusion may not produce a failed-login pattern. Operators should audit for unexpected accounts, review login logs for sessions from unfamiliar sources, and check whether any account holds permissions broader than its intended role.

Limits

Two limits apply to this analysis. First, the ZoomEye figure describes operating-system fingerprint exposure across all RouterOS deployments, which is a much larger population than the set of devices running affected versions with the relevant services exposed. It indicates the size of the installed base, not the size of the vulnerable population. Second, the descriptions above are drawn from the NVD entries; the vendor advisory remains authoritative for affected version ranges and fixed releases on each branch.
The broader point is that authentication-path parsing flaws in edge devices deserve priority beyond their individual CVSS scores. The device is the boundary, the flaws require no credentials, and the fix is a version upgrade that many deployments postpone because an edge router outage is immediately visible to users. That operational pressure is exactly what makes a scheduled, tested upgrade path worth maintaining before it is needed.

References

Top comments (0)