Recommended Free Tools
CVE-2026-86060 is a RouterOS SSH privilege-escalation flaw, not by itself an authentication bypass. A no-credentials takeover is possible in the scenario CERT Polska describes only when it is chained with CVE-2026-67276 and the router’s SSH service is reachable from a public network. Upgrade to the fixed release for your RouterOS branch, restrict management access, and investigate for compromise rather than treating an update as proof the device is clean.
What CVE-2026-86060 does—and what “without credentials” means
The Canadian Centre for Cyber Security classifies CVE-2026-86060 as CWE-88, improper neutralization of argument delimiters in a command, or argument injection, and says it may permit remote privilege escalation. CERT Polska describes the affected SSH login path: a crafted username beginning with a disallowed character could cause the resulting session to gain full administrative privileges. Canadian Centre for Cyber Security advisory, September 10, 2026; CERT Polska report, September 5, 2026.
As an Amazon Associate I earn from qualifying purchases.
The “without credentials” description refers to a chain, not CVE-2026-86060 alone. The companion CVE-2026-67276 affected SSH public-key verification. CERT Polska says RouterOS did not compare the entire RSA public key assigned to a user; an attacker who knew the username and public modulus could craft a different key and log in without the matching private key, gaining that account’s privileges. Chaining that authentication bypass with CVE-2026-86060 could yield full administrative control without authentication when SSH was reachable from a public network.
CERT Polska reports observing the chain in attacks against internet-accessible RouterOS devices, with activity beginning at least September 2, 2026. That is the earliest activity described in its report, not proof of the first exploitation date. The report says the released patches prevent the observed attacks. It does not establish a total number of compromised routers or a representative prevalence rate.
#1 Best Overall
- hEX also known as RB750Gr3 is a five port Gigabit Ethernet router for locations where wireless connectivity is not required
- The device has a full size USB port. This new updated revision of the hEX brings several improvements in performance
- It is affordable, small and easy to use, but at the same time comes with a very powerful dual core 880MHz CPU and 256MB RAM
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude
- Dimensions: 113x89x28mm; Storage size: 16 MB; Passive PoE (PoE in); PCB temperature monitor, Voltage monitor and Mode button
Which RouterOS versions contain the fix?
Use the fixed release that matches the device’s branch. MikroTik lists these versions, and the Canadian advisory maps them to the relevant branches:
| RouterOS branch | Fixed release |
|---|---|
| 6.x | 6.49.21 |
| 7.x long-term | 7.23.4 |
| 7.x stable | 7.24.2 |
| Development | 7.25 beta 3 |
Identify the installed branch and version, install its applicable fixed release or a later supported release, then confirm the device is actually running the updated version. The vendor’s September 3, 2026 bulletin says, “Most configurations are not at risk, but upgrading is highly recommended.” That is MikroTik’s general statement, not an individual assessment of your router’s exposure. MikroTik security bulletin, September 3, 2026.
Rank #2
- Wired Gigabit Router – 5x Gigabit Ethernet ports, 2.5G SFP, PoE-Out, USB, powered by RouterOS
What to do if you cannot patch immediately
Reduce exposure until you can install the fix. CERT Polska recommends disabling exposed services or limiting them to trusted management networks, especially SSH, WWW/WWW-SSL, and the bandwidth-test server. MikroTik advises against exposing SSH to untrusted networks and recommends restricting access to trusted IP addresses or using a VPN such as WireGuard instead of opening management ports.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Prioritize devices with SSH reachable from the public internet.
- Disable exposed management services that are not needed, or restrict them to trusted networks and addresses.
- Do not treat these controls as a substitute for upgrading: they reduce exposure while patching is pending.
CERT Polska also cautions against initiating TLS connections or using RouterOS built-in SSH clients from an unpatched device in the circumstances described in its report. Follow the report’s guidance for affected devices rather than assuming that a management connection from the router is harmless. CERT Polska’s mitigation guidance.
How to check for signs of compromise
After updating, review logs and configuration. CERT Polska lists these observed log artifacts as reasons for immediate investigation:
login failure for user -2 from <ip> via sshuser <name> added by ssh:-2@<ip>- An unexpectedly highly privileged account named
ops.
These are indicators, not a complete detection rule or a durable IP blocklist. CERT Polska warns that their absence does not rule out unauthorized activity.
Rank #4
- MikroTik RouterBOARD C52iG-5HaxD2HaxD-TC-US (US Version) hAP ax (WiFi6) Quad-Core IPQ-6010 864 MHz, RAM 1GB, RouterOS, License level 4 It's time to supercharge your home network with the Generation
- hAP ax has everything you might need in a primary home access point - and more
- Forget endless reviews and comparisons - this is the perfect device for 99% of homes
- Wireless signal is now stronger than ever
- Here are the two main ingredients of hAP ax's success: a state-of-the-art dual-band, dual-chain 4-4
MikroTik says RouterOS checks devices for compromise and may mark some as Flagged in the log. The RouterOS manual explains that startup configuration analysis can disable suspicious entries and set the flagged parameter. A Flagged indication warrants treating the device as compromised and performing a full audit; an unflagged device is not thereby proven safe. RouterOS Manual: Device mode—Flagged status, version 7.26.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Inspect the configuration and activity for unexplained changes, including:
Best Value
- W128339515
- Unknown user accounts and privilege changes
- Unexpected scripts or scheduler tasks
- Proxy servers or tunnels that you did not configure
- Authentication logs and network activity suggesting unauthorized access
- Other configuration changes that do not match your records
What to do if compromise is suspected
- Isolate the router. Remove its untrusted network exposure while preserving access needed for incident handling.
- Preserve evidence before resetting. Save available logs and configuration so the incident can be investigated.
- Rebuild from a verified configuration. Do not blindly restore a full backup from a potentially compromised router; it may reintroduce unauthorized changes.
- Rotate secrets. Change passwords, keys, and other credentials or secrets that the device could have exposed.
- Audit the rebuilt device. Confirm the fixed release is installed, management access is restricted, and unexpected accounts or configuration changes are absent.
CERT Polska lists CVSS 9.2 for both CVE-2026-67276 and CVE-2026-86060. The score communicates severity, not how many routers have been compromised. The Canadian Centre for Cyber Security also says CISA added CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10, 2026; prioritize internet-exposed management access accordingly. GitHub Advisory Database entry for CVE-2026-86060; Canadian Centre for Cyber Security advisory.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
