• CISA's 13 September remediation deadline has passed for the actively exploited RouterOS flaw CVE-2026-86060
  • Installing the fix stops the observed attack route but does not establish whether a router was changed before it was patched

The fact

The US Cybersecurity and Infrastructure Security Agency's 13 September remediation deadline has passed for CVE-2026-86060, a MikroTik RouterOS privilege-escalation flaw added to its Known Exploited Vulnerabilities catalogue on 10 September. The deadline applies to covered federal civilian agencies, not every MikroTik operator.

CERT Polska said attackers had been using a chain of RouterOS flaws against devices whose SSH management service was reachable from public networks. It confirmed that the released patches stop the attacks it observed. MikroTik lists fixed releases 7.24.2, 7.23.4 and 6.49.21, with 7.25 beta 3 also carrying the fix.

Updated RouterOS releases can mark selected signs of unauthorised changes as "Flagged", but CERT Polska and MikroTik both warn that the absence of a flag does not prove a device is clean. Administrators are advised to inspect configurations after updating.

The assessment

Updating changes what an attacker can do next; it does not reconstruct what happened before the update. That matters for a router that was exposed before it was patched. Traffic can continue normally even if someone has added an account, script or other administrative change in the background.

Operators therefore have more to check than the RouterOS version. CERT Polska points to unfamiliar users, scripts, scheduler entries, proxy servers and tunnels as configuration items worth reviewing. Where compromise is suspected, it recommends preserving evidence, isolating the device and recovering from a trusted configuration rather than automatically restoring a backup that may already contain the unwanted change.

For BTW readers, the incident is more convincingly closed when the router is both patched and returned to a reviewed, trusted state. A device staying online demonstrates continuity; it does not establish who still controls its configuration.

What to watch

Watch whether operators report compromise reviews as well as patch completion, particularly for routers that exposed SSH to public networks. Further MikroTik or CERT Polska guidance could add indicators of compromise or recovery steps as more attacks are analysed. Confirmed rebuilds from trusted configurations would provide stronger evidence of recovery than uptime alone.