Update your router for the actively exploited critical vulnerabilities in MikroTik RouterOS

Two critical security vulnerabilities actively exploited by attackers have been identified in the widely used MikroTik RouterOS operating system in homes and workplaces. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.

What do the vulnerabilities do?

The first vulnerability, CVE-2026-86060, is a command injection flaw caused by command arguments not being parsed correctly. Through this vulnerability, an attacker can change the device’s trusted settings.

The second, CVE-2026-67277, stems from a lack of authentication in a critical function. This vulnerability allows an attacker to read kernel memory and cause a denial of service condition on the device.

Why should you hurry?

CISA’s KEV catalog includes only vulnerabilities that have actually been exploited in the real world. Both vulnerabilities have also been associated with ransomware campaigns. The agency had required systems to patch these vulnerabilities by September 13, 2026.

What should you do?

Log in to your MikroTik device’s management panel and update RouterOS to the latest version. After updating, make sure the management interface is not accessible from the internet and set a strong administrator password.

Source: CISA Known Exploited Vulnerabilities (KEV) Catalog