Two MikroTik RouterOS Vulnerabilities Added to CISA KEV Catalog

What's on the official record

10 September — CVE-2026-67277 added to the KEV catalog. CISA added CVE-2026-67277, a MikroTik RouterOS missing authentication for critical function vulnerability (CWE-306), to the Known Exploited Vulnerabilities Catalog on 10 September 2026. The record states the vulnerability allows kernel memory disclosure and denial of service in the btest service. The remediation due date for federal civilian agencies is 13 September 2026, and the catalog version is 2026.10.21. The record names fixed versions 7.24.2 and 7.23.4. FIRST's EPSS model estimates a 0.016 probability of exploitation (75th percentile, 23 October 2026). CISA's ADP records SSVC exploitation as active, automatable as yes, and impact as partial. The catalog does not record known ransomware use.

10 September — CVE-2026-86060 added to the KEV catalog. CISA added CVE-2026-86060, a MikroTik RouterOS improper neutralization of argument delimiters in a command vulnerability (CWE-88), to the Known Exploited Vulnerabilities Catalog on 10 September 2026. The record states the vulnerability allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation. The remediation due date for federal civilian agencies is 13 September 2026, and the catalog version is 2026.10.21. The record names fixed versions 7.24.2 and 7.23.4. FIRST's EPSS model estimates a 0.064 probability of exploitation (94th percentile, 23 October 2026). CISA's ADP records SSVC exploitation as active, automatable as yes, and impact as total. The catalog does not record known ransomware use.

Assessment

For a platform or AI-stack owner, the record lets you check each RouterOS instance against the first fixed versions 7.24.2 and 7.23.4 and patch or isolate any instance below them. The record ties CVE-2026-67277 to kernel memory disclosure and denial of service in the btest service, and CVE-2026-86060 to privilege escalation through the trusted policy mask. You can decide whether to pull a version or keep serving while you rotate affected instances onto the fixed releases.

For a cyber underwriter, the record lets you check a policyholder's RouterOS estate against fixed versions 7.24.2 and 7.23.4 and require a control where instances sit below them. CISA's ADP records exploitation as active and automatable for both vulnerabilities, with impact partial for CVE-2026-67277 and total for CVE-2026-86060. You can use that severity split to price or condition coverage while the catalog records no known ransomware use for either.

What would change this call

A revised EPSS estimate or SSVC decision from CISA's ADP would change the severity weighting. A catalog update recording ransomware use for either CVE would change the underwriting posture.

What to check next

Confidence

Filed 25 October 2026 from the record dated 10 September 2026.

Sources

[1] MikroTik RouterOS Missing Authentication for Critical Function Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-67277

[2] CVE record CVE-2026-67277 — https://www.cve.org/CVERecord?id=CVE-2026-67277

[3] MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-86060

[4] CVE record CVE-2026-86060 — https://www.cve.org/CVERecord?id=CVE-2026-86060

[5] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog