CISA added two of the six September MikroTik RouterOS flaws to the Known Exploited Vulnerabilities catalog on September 10, with a federal remediation deadline of September 13 — and the SSH authentication bypass that CERT Polska says attackers use to get in is not one of them.
What happened
On September 10, 2026, CISA added two MikroTik RouterOS vulnerabilities to the Known Exploited Vulnerabilities catalog. NVD’s republication of the catalog data carries, for both records, a cisaExploitAdd of 2026-09-10 and a cisaActionDue of 2026-09-13. That is a three-day clock, and it lands on Sunday, September 13.
The two are:
- CVE-2026-86060, which CISA names “MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability.” NVD scores it 9.2 critical on CVSS 4.0 and classes it CWE-88. The record describes “an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation.”
- CVE-2026-67277, which CISA names “MikroTik RouterOS Missing Authentication for Critical Function Vulnerability.” NVD scores it 8.8 high on CVSS 4.0 and classes it CWE-306. It sits in the bandwidth-test service: RouterOS “accepts unauthenticated ‘related’ btest connections before primary session authentication completes,” leaking uninitialized kernel packet buffer data when
random-data=false, and an unchecked inverted packet-size interval triggers an unsigned integer underflow that can restart the kernel.
The required action CISA attaches is the standard BOD 26-04 text. On the CVE-2026-67277 record it reads, verbatim: “Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.” The CVE-2026-86060 record carries the same required-action boilerplate.
Severity Daily covered the underlying disclosure on September 5, in MikroTik withheld the RouterOS advisory to buy patching time, and working exploits were published the next day. That story is the background; the KEV addition and the federal deadline are what is new.
The half of the chain that is not on the catalog
CERT Polska’s September 5 writeup, the primary account of the exploitation, describes three flaws and a chain. CVE-2026-67276 is an SSH authentication bypass: RouterOS compares the key type and modulus of an RSA public key but omits the exponent, so an attacker who knows an authorized modulus can present a key with exponent one, forge a signature, and open an SSH command channel as that user without holding the private key. CVE-2026-86060 is the privilege escalation that follows. CVE-2026-67277 is the bandwidth-test memory disclosure and crash.
CERT Polska’s language is that the chain was “exploited to take full control of devices” reachable over SSH. In that account the authentication bypass is the door and the argument-delimiter flaw is what happens after the attacker is through it.
CVE-2026-67276 is not in the catalog. Its NVD record carries no cisaExploitAdd, no cisaActionDue, and no cisaVulnerabilityName, while both of its neighbors now do. NVD scores it 9.2 critical — the same score as CVE-2026-86060, and higher than CVE-2026-67277, which was added.
We do not know why. CISA does not publish its reasoning for individual additions, and an absence from the catalog is not a statement that a flaw is unexploited. It may yet be added; NVD lags the catalog by hours, and this record is one worth re-checking. But as of this writing the catalog obliges federal agencies to remediate the escalation and the crash on a three-day clock while saying nothing about the bypass that CERT Polska puts first in the sequence.
Why it matters
The practical effect is small for anyone patching properly, because all three flaws are fixed by the same RouterOS releases. An agency that upgrades to close CVE-2026-86060 closes CVE-2026-67276 in the same step, whether or not the catalog asked it to. The risk is not to the organization that patches the box. It is to the organization that works the catalog as a list.
That is a real operating model. Plenty of vulnerability programs treat KEV as the queue: the scanner tags what is listed, the ticket cites the due date, and what is not listed waits for the ordinary monthly cycle. For a shop that mitigates rather than upgrades — restricting bandwidth-test, filtering SSH by source, tightening a firewall rule to satisfy the specific finding in front of it — a catalog naming two of three chain links produces a device that is compliant and still reachable. This is the same shape Severity Daily has filed before as a chain scored below the chain it enables: the record decomposes an attack into parts and then rates the parts, and the sum is not preserved.
The scale here is what makes it worth saying out loud. The Shadowserver Foundation added MikroTik SSH identification to its daily scans on September 4 and reported “at least 122,500 MikroTik devices with SSH accessible found per 24 hour scan window on 2026-09-05.” That is exposure, not compromise, and it is not a count of vulnerable devices — Shadowserver cannot tell patched from unpatched from the outside, and neither can we. But it is the honest denominator for a flaw whose precondition is SSH reachable from the internet, and it is six figures.
The other thing worth noticing is the shape of the timeline. MikroTik published its advisory on September 3 and deliberately withheld detail: “To give time to update your systems, we are not currently publishing detailed information.” Working exploits were public on September 4. CERT Polska published on September 5 and dated the earliest attack traffic it saw to at least September 2 — before the patch. The catalog addition came on September 10, eight days after the first observed exploitation and seven days after the fix was available. Federal agencies now have three days from that addition. The window that mattered closed a week before the clock started, which is an argument for treating a vendor advisory with a withheld-detail notice as its own signal rather than waiting for the catalog to confirm it.
What to do
Upgrade. MikroTik’s fixed releases are 7.25 beta 3, 7.24.2, 7.23.4 (long-term), and 6.49.21. CVE-2026-67276 affects only the 7.x branch and is fixed in 7.23.4 and 7.24.2; the other two reach back into 6.x, which is why 6.49.21 exists. Upgrading closes all three whatever the catalog lists.
If you cannot upgrade today, the mitigation MikroTik names is to keep SSH off untrusted networks and reach management over a VPN rather than an open port. Treat that as a stopgap for the SSH-borne flaws only — it does nothing for the bandwidth-test issue, which rides UDP.
Then check for compromise, because exploitation predates the patch. CERT Polska’s indicators are specific: log entries reading login failure for user -2, log entries of the form user <name> added by ssh:-2@<ip>, and the presence of a privileged account named ops. The attack traffic CERT Polska observed came from 82.192.72.4, seen since at least September 2, and 103.102.31.18. MikroTik’s own advice after upgrading is to inspect the configuration for unknown scripts, users, or unrecognized settings, and to review logs for entries marked “Flagged.”
Federal civilian agencies: the due date on both catalog entries is September 13, 2026, and the required action text points at BOD 26-04’s forensic triage requirements as well as remediation. Given that exploitation was observed before the fix shipped, the triage half is the part that actually earns its keep here.
Sourcing note
KEV dates for CVE-2026-86060 and CVE-2026-67277 were read from NVD’s API records for each CVE, which republish CISA’s own cisaExploitAdd, cisaActionDue, cisaVulnerabilityName, and cisaRequiredAction fields. cisa.gov returns 403 to automated fetching, so CISA’s alert page for the addition was not read directly; its existence and title, “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” dated September 10, 2026, came from a search result and a third-party republication, and the CVE identities and dates were then confirmed one record at a time against NVD. The catalog mirror at cisagov/kev-data was fetched but truncates well before the end of the file and is not usable for enumerating recent additions; an attempt to do so returned a wrong answer, as it has before.
NVD’s own lag was visible during reporting. On a first read on the morning of September 11, CVE-2026-67277’s record showed a lastModified of 2026-09-09T05:17:28.263 and carried no CISA fields at all. A second read minutes later returned lastModified of 2026-09-11T12:52:29.533, status “Analyzed,” and the full CISA block. Both values are reported here rather than only the later one. CVE-2026-67276’s record was re-read on the afternoon of September 11 and still carried no CISA fields, with a lastModified of 2026-09-09T05:17:28.130 and a status of “Awaiting Analysis.”
The vulnerability descriptions and CVSS 4.0 scores are NVD’s. CERT Polska’s advisory of September 5, 2026, is the source for the chain, the attacker IP addresses, and the indicators of compromise. MikroTik’s “September 2026 vulnerability” advisory of September 3, 2026, is the source for the fixed versions and the quoted vendor language. The 122,500 figure is the Shadowserver Foundation’s, posted September 6, 2026, and is a count of MikroTik devices with SSH reachable during a 24-hour scan window on September 5 — not a count of vulnerable or compromised devices.
Unresolved: whether CVE-2026-67276 will be added to the catalog, and CISA’s reasoning for listing two of the three flaws CERT Polska describes. No count of compromised devices has been published by anyone. Attribution has not been established and is not asserted here.