PatchTheCVErouteros vulnerabilities and fixes
Recent CVEs affecting routeros, with upgrade or downgrade steps. 3 tracked.
routeros has 3 tracked vulnerabilities, 1 critical and 3 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 3. Most recent: 2026-09-05. Highest priority: CVE-2026-86060 (score 96/100).
- CVE-2026-67279 MEDIUM 6.5 EXPLOITED UPGRADE Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
- CVE-2026-67277 HIGH 8.2 EXPLOITED UPGRADE MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
- CVE-2026-86060 CRITICAL 9.8 EXPLOITED UPGRADE MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
FAQ
How do I fix routeros vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is routeros being exploited right now?
Yes: 3 routeros CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.
Which routeros CVE should I patch first?
CVE-2026-86060 currently ranks highest (96/100): MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability.