MikroTik RouterOS CISA KEV: Update and Review Router Security
September 10, 2026
Security maintenance priority: CISA added CVE-2026-86060 and CVE-2026-67277, affecting MikroTik RouterOS, to its Known Exploited Vulnerabilities catalog on September 10, 2026. Owners of affected routers should arrange the applicable vendor update and review management exposure. FixItPhill has not assessed your router or determined whether it was compromised.
The KEV additions are new; the vendor disclosure is not. MikroTik’s security announcement is dated September 3, and the CERT-PL CVE records were first published September 5. Do not interpret a later database update as the date an attack began. CISA’s September 13 remediation deadline applies to the federal agencies covered by its directive; other organizations should prioritize their own exposed assets promptly.
Match the RouterOS branch before updating
The two CERT-PL records list the same affected branch boundaries. Keep these rows separate when checking an installed release.
| Affected branch range | Listed fixed boundary |
|---|---|
| 7.24 releases before 7.24.2 | 7.24.2 |
| 7.0.0 through releases before 7.23.4 | 7.23.4 |
| 6.0.0 through releases before 6.49.21 | 6.49.21 |
MikroTik independently lists 7.24.2, 7.23.4 and 6.49.21 as containing the fix. Its announcement also lists 7.25 beta 3, which is a prerelease, not our production upgrade recommendation. These are the advisory’s fixed versions, not a claim that they remain the newest releases. Select a supported, compatible fixed release through MikroTik’s current update guidance.
Reduce exposure and complete maintenance
MikroTik recommends limiting router management to trusted access and using a secure management VPN where appropriate. Default restrictions are not evidence that a particular installed configuration remains unchanged or safe. The vendor recommends updating even devices whose typical home configuration presents less immediate risk.
- Inventory the router model, RouterOS branch, installed release, management owner and services that depend on it. Include remote sites where an interrupted connection could prevent recovery.
- Have the responsible network administrator compare the deployed configuration with approved management-access requirements. Do not expose additional services merely to perform a test.
- Choose the applicable fixed release, confirm hardware and network compatibility, and plan the maintenance window with a documented recovery owner.
- After updating, verify the reported version, authorized administrator access, expected routing, VPN connectivity and monitoring. Record unresolved exceptions for follow-up.
Keep compromise review separate from patching
Installing a fixed release alone does not establish that a router is clean. MikroTik directs administrators to investigate its Flagged status and to inspect configuration for unexpected changes even when that status is absent. Follow the vendor’s recovery documentation and your incident-response process; do not simply clear a warning or disable a protection to close the maintenance ticket.
Where compromise is suspected, preserve relevant evidence through your established process and involve the responsible security team. An update record, a successful connection test and a completed incident review answer different questions. Document each outcome separately instead of treating one as proof of the others.
Coordinate the services behind the router
Use the security maintenance hub and hosting security guidance for adjacent work. For hosted sites, WordPress support can coordinate application checks after the network team completes its change. This RouterOS advisory does not establish a WordPress, cPanel or Proxmox vulnerability.
Image: existing generic server-administration illustration, not a RouterOS interface or evidence about a real deployment.
