MikroTik RouterOS on CISA KEV: 6.49.21 Is the Only Fix for Any 6.x
CISA put two MikroTik RouterOS flaws on its Known Exploited Vulnerabilities catalog on September 10, 2026, with a three-day deadline. The entries are CVE-2026-86060 and CVE-2026-67277, both found by CERT Polska and both fixed by MikroTik on September 3. The fix list in MikroTik's bulletin is four releases long: 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21. One of those four is a 6.x release. That is the lifecycle fact of the week.
CERT Polska's CVE page publishes the vulnerable range for each flaw, and for both CISA-listed flaws it reads the same way: from 7.24 below 7.24.2, from 7.0.0 below 7.23.4, and from 6.0.0 below 6.49.21. Every 6.x build that is not 6.49.21 is in scope. MikroTik's 6.x fix exists only on the 6.49 line, which is the last 6.x line it still maintains. On our RouterOS page, 6.48 and every earlier 6.x line is already marked end-of-life, and 6.48's final release, 6.48.7, shipped on May 23, 2023.
What the two catalog entries are, and what they are not
CERT Polska disclosed six RouterOS vulnerabilities on September 5, two days after MikroTik's fixes. Its advisory singles out three, and the two CISA chose are among them:
| CVE | What it is | CVSS | Vulnerable range (CERT Polska) | On CISA KEV |
|---|---|---|---|---|
| CVE-2026-86060 | SSH session privilege manipulation via a crafted username; the session ends up with full administrative rights | 9.2 | 6.0.0 to 6.49.20; 7.0.0 to 7.23.3; 7.24 to 7.24.1 | Yes, September 10 |
| CVE-2026-67277 | Bandwidth-test service accepts an unauthenticated connection into a post-login state; leaks kernel memory or restarts the router | 8.8 | 6.0.0 to 6.49.20; 7.0.0 to 7.23.3; 7.24 to 7.24.1 | Yes, September 10 |
| CVE-2026-67276 | SSH authentication bypass: RouterOS matched an RSA key by modulus alone, so a forged key with exponent one logs in without the private key | 9.2 | 7.9 to 7.23.3; 7.24 to 7.24.1 | No, as of September 10 |
The chain CERT Polska named MikroTrick, and confirmed in use against devices with SSH reachable from the internet, is the third and the first rows together: CVE-2026-67276 to get in, CVE-2026-86060 to become administrator. That chain needs 7.9 or later, because the authentication bypass does not exist on 6.x. On a 6.x device the two catalog entries stand alone: a privilege escalation for anyone who can reach SSH, and an unauthenticated memory leak and crash on the bandwidth-test service. MikroTik's own bulletin says most configurations are not at risk and gives no detail, deliberately, to leave time to patch; the exposure that matters, in both CERT Polska's and MikroTik's advice, is SSH, WebFig and the bandwidth-test server reachable from outside trusted management networks. BleepingComputer, citing The Shadowserver Foundation, put the number of MikroTik devices with an exposed SSH interface at about 122,500 on September 5.
Every RouterOS line against the fix list
The table below is our lifecycle data for the lines that matter this week, with the fix release from MikroTik's bulletin against each. Release dates are bound to the data behind the RouterOS page; the fix and channel facts are from MikroTik's changelog, read twice on September 10.
| Line | Channel | First release | Fixed build | Status on our data |
|---|---|---|---|---|
| 7.24 | Stable | August 17, 2026 | 7.24.2 | Current stable line |
| 7.23 | Long-term | May 26, 2026 | 7.23.4 (7.23.5 followed on September 4) | Maintained long-term line |
| 7.22 | Superseded | March 10, 2026 | None | Superseded by 7.23; in the vulnerable range |
| 7.21 | Long-term (previous) | January 12, 2026 | None; last build 7.21.5 on July 6, 2026 | In the vulnerable range; the long-term channel now serves 7.23 |
| 6.49 | Stable and long-term (6.x) | October 6, 2021 | 6.49.21 | Last maintained 6.x line |
| 6.48 | None | December 22, 2020 | None; last build 6.48.7 on May 23, 2023 | End-of-life; in the vulnerable range |
| 6.47 and earlier | None | 2020 and before | None | End-of-life; in the vulnerable range from 6.0.0 |
Two things in that table changed on our side today. Upstream lifecycle data still listed 6.49's latest build as 6.49.20; MikroTik's changelog shows 6.49.21 on September 3, so the page now serves it. And 7.23 had been marked end-of-life on the day 7.24 shipped, the convention for a superseded stable line; MikroTik's changelog lists 7.23.4 and 7.23.5 on the long-term channel this month, so 7.23 is served as a maintained long-term line. Both corrections carry their source on the accuracy page.
What to do, by line
7.24: update to 7.24.2 or later. 7.23 long-term: 7.23.4 or later; 7.23.5 is current. 7.21 long-term, 7.22, or any older 7.x: there is no fixed build in your line; move to 7.23.4 or later on the long-term channel, or 7.24.2 on stable.
6.49: update to 6.49.21. 6.48 or older: there is no fixed build in your line. The in-line path is 6.49.21; the alternative is a fixed 7.x release, which is a major upgrade with its own configuration migration. Until the update is applied, CERT Polska's interim advice is to disable or firewall SSH, WWW and WWW-SSL, and the bandwidth-test server from everything outside trusted management networks, and to avoid outbound TLS connections and the built-in SSH client from an unpatched device.
After updating, check whether you were already hit. The fixed releases add a compromise marker: look for the device-compromise message in the log and the flagged value in the output of /system/device-mode/print, then review users, scripts and scheduled tasks for anything unfamiliar. CERT Polska is explicit that the absence of the marker does not rule out an earlier compromise, and that a flagged device should be restored to factory settings and rebuilt from a trusted configuration, with every password and key changed, not restored from a backup taken while it was exposed.
Federal agencies: CISA's due date for both entries is September 13, 2026, under BOD 26-04.
Frequently Asked Questions
Which RouterOS versions fix CVE-2026-86060 and CVE-2026-67277?
MikroTik's September 2026 security bulletin names four releases that contain the fix: 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21, all published on September 3, 2026. CERT Polska, which found the flaws, validated the fixes. There is no fixed build for any 6.x line other than 6.49.
Is RouterOS 6.48 or an older 6.x version affected?
Yes, according to CERT Polska's published vulnerable ranges: both CISA-listed flaws affect RouterOS from 6.0.0 below 6.49.21. MikroTik shipped the 6.x fix only as 6.49.21, so a device on 6.48 or earlier has no fixed build in its own line and must move to 6.49.21 or to a fixed 7.x release. 6.48's last release, 6.48.7, shipped on May 23, 2023.
What is MikroTrick?
CERT Polska's name for the chain of CVE-2026-67276, an SSH authentication bypass rated CVSS 9.2 that affects 7.9 up to 7.23.3 and 7.24 up to 7.24.1, with CVE-2026-86060, the crafted-username privilege manipulation. Together they let an attacker who knows a username and the public modulus of that user's RSA key take full administrative control of a device whose SSH service is reachable, without the private key. CERT Polska has confirmed the chain is being used in attacks. CISA's two listings are CVE-2026-86060 and CVE-2026-67277; CVE-2026-67276 is not on the catalog as of September 10, 2026.
What is the CISA deadline?
CISA added both entries to the Known Exploited Vulnerabilities catalog on September 10, 2026, with a due date of September 13, 2026 for federal civilian agencies under BOD 26-04: three days, the shortest window CISA uses.
Related
- MikroTik RouterOS — every 6.x and 7.x line with its release date, latest build and status, plus the CISA KEV history for RouterOS
- EOS Edge Device List — every edge platform we track with a CISA KEV history
- Exploited & Unpatchable — the feed of KEV entries on products past their fix window
- How we verify our dates — the rules every number on this site is held to