MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-86060
Published date: 20 July 2026, 9:43 am
Source: MyCERT (CyberSecurity Malaysia) — https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=1921af09-3caa-47df-bb9d-1afd4bcd86cf
Published date: 22 July 2026, 1:26 pm
Source: MyCERT (CyberSecurity Malaysia) — https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=26c7a882-e759-4120-b27d-cda75da7a9d2
Published date: 22 July 2026, 1:26 pm
Source: MyCERT (CyberSecurity Malaysia) — https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=ffb30de3-1c6f-40a8-8336-252c3a9ec8bf
