VIRY.CZRADAR
sektor
téma
typ textu
zrušit filtry

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability (CVE-2026-86060)

9 karet z 13 položek · v celém archivu · celý přehled CZ · EN/orig

CVE-2026-86060

KEV ✓ EPSS 0.06 EPSS k 21. 10. 2026 náprava do 13. 9. 2026

Hodnocení závažnosti

9.2 CVSS 4.0 CERT-PL

útok odkudkoli z internetu žádné ochrany se neobcházejí jen v určitém nastavení nebo načasování bez přihlášení bez zásahu uživatele
dopad plný únik dat úplná změna dat úplný výpadek
přesah bez úniku v okolních systémech beze změny v okolních systémech bez výpadku v okolních systémech

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

zvyšuje závažnost mírně zvyšuje závažnost snižuje závažnost

cve.org · NVD

Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu. Fakta o samotném CVE jsou nahoře.

MikroTrick: technical analysis, disclosure process, and the use of LLM agents

We describe the technical details of the MikroTrick chain, which combines the CVE-2026-67279 and CVE-2026-86060 vulnerabilities and, when chained, allowed full takeover of a device without authentication. We explain the mechanics of the attacks observed in the wild, the coordinated disclosure of both vulnerabilities, and the practical role of LLM agents in the RouterOS research.

KEV ✓ EPSS 0.06 CVE-2026-67279 CVE-2026-86060 MikroTik PL

tg: zneužíváno tg: rozbor tp: AI

· CERT Polska · MikroTrick: technical analysis, disclosure process, and the use of LLM agents

14th September – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 14th Setpember, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES IDScan.net, a US identity verification provider, has disclosed a data breach after detecting unauthorized access on September 1. Exposed data included names and government identification numbers, while a criminal marketplace advertised a collection containing millions of identity documents, including driver’s licenses, associated with the…

KEV ✓ EPSS 0.97 CVSS 10.0 CVE-2026-67276 CVE-2026-72898 CVE-2026-81963 CVE-2026-85046 CVE-2026-85706 CVE-2026-85880 CVE-2026-86060 Microsoft GitLab MikroTik Anthropic IL

tg: incident tg: zranitelnost tg: přehled tp: malware tp: únik dat tp: AI

· Check Point Research · 14th September – Threat Intelligence Report

SPOJENO PŘES CVE AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060

Number: AL26-020Date: September 10, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Cyber…

KEV ✓ EPSS 0.06 CVE-2026-67276 CVE-2026-67277 CVE-2026-86060 MikroTik CA US

tg: varování tg: zneužíváno tg: zranitelnost

· Cyber Centre Kanada · AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060 · BleepingComputer · Hackers exploit new MikroTik RouterOS flaws to hijack routers

· zachyceno

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational…

KEV ✓ EPSS 0.06 CVE-2026-67277 CVE-2026-86060 MikroTik veřejná správa US

tg: zneužíváno tg: zranitelnost tg: regulace

· zachyceno · CISA Advisories · CISA Adds Two Known Exploited Vulnerabilities to Catalog

· zachyceno

· zachyceno

Actively exploited MikroTik RouterOS zero-day vulnerability

Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv4.0: 9.2, CVEs: CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, CVE-2026-86060, CVE-2026-67277, CVE-2026-67276, Summary: MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels. There is evidence that these vulnerabilities are under active exploitation. This is an important security update. Most configurations are not at risk, but upgrading is highly…

KEV ✓ EPSS 0.06 CVSS 9.2 CVE-2026-67276 CVE-2026-67277 CVE-2026-67278 CVE-2026-67279 CVE-2026-67281 CVE-2026-86060 MikroTik FI

tg: zneužíváno tg: zranitelnost

· zachyceno · NCSC-FI · Actively exploited MikroTik RouterOS zero-day vulnerability

SPOJENO PŘES CVE MikroTik router flaws allow takeover without a password

CERT Polska warns that attackers are actively exploiting a chain of critical MikroTik RouterOS flaws to seize control of routers exposed to the internet. Although the warning comes from Poland’s national cybersecurity response team, MikroTik routers are sold worldwide, including in the US. The vulnerabilities can affect users anywhere if their router is running a vulnerable version of RouterOS and its SSH remote-management service is accessible from the internet. Attackers are exploiting two…

KEV ✓ EPSS 0.06 CVSS 9.2 CVE-2026-67276 CVE-2026-86060 MikroTik US HR IT

tg: zneužíváno tg: zranitelnost tg: návod tp: identita

· Malwarebytes Labs · MikroTik router flaws allow takeover without a password · CERT.hr · Upozorenj: kritična ranjivosti u MikroTik RouterOS-u. Preporučuje se hitna nadogradnja. · CSIRT Itálie (ACN) · MikroTik: rilevato sfruttamento in rete di nuove vulnerabilità