Two vulnerabilities affecting MikroTik RouterOS have been added by the U.S. Cybersecurity and Infrastructure Security Agency to the KEV catalog, the list of flaws for which the agency has found evidence of real-world exploitation. The update, published on September 10, 2026, involves CVE-2026-67277 and CVE-2026-86060: two distinct issues, but both relating to the operating system used on MikroTik network devices.
The first, CVE-2026-67277, is classified as a missing authentication for critical function vulnerability. The second, CVE-2026-86060, involves improper handling of argument delimiters in a command. In its advisory, CISA did not disclose additional technical details about the observed campaigns, threat actors, targets, or the specific methods by which the flaws are being exploited. However, the core significance of the catalog addition is precisely the existence of evidence of active exploitation.
For administrators and organizations using RouterOS, the update elevates the urgency of verification. A public vulnerability can often remain a routine item on a maintenance checklist; its inclusion in the Known Exploited Vulnerabilities Catalog indicates that it must no longer be treated merely as a theoretical risk. The priority becomes identifying affected devices—especially those that are publicly exposed—applying available mitigation guidance, and assessing whether unauthorized access or compromises may have occurred prior to remediation.
What the KEV catalog signals
The KEV Catalog is not a general inventory of known vulnerabilities. Its inclusion criteria are more selective: to be considered, a flaw must have a CVE identifier, evidence of exploitation, and sufficiently clear mitigation guidance. The catalog therefore serves to direct remediation toward flaws that pose a concrete, active risk, preventing security teams from treating every CVE with the same priority.
In the case of MikroTik, CISA included two categories of weakness in the same update that can take on particular significance on edge devices. A missing authentication issue can affect access to a function that should be protected by credential or privilege verification. The failure to neutralize command argument delimiters, on the other hand, concerns how input is interpreted by the system. The official definitions identify the nature of the issues, but the CISA advisory does not allow determining which configurations are vulnerable, what operational impact occurs on each device, or whether the two flaws can be chained.
This distinction also matters in incident response. In the absence of further public details, it is not correct to assume that every RouterOS installation is equally exposed or that inclusion in the KEV equates to confirmation of widespread compromise. At the same time, ignoring the advisory because information on campaigns is lacking would be a mistake: the agency's communication confirms that exploitation is not hypothetical.
Routers and exposed devices: why remediation should be prioritized by risk
Routers occupy a sensitive position in network infrastructure: they manage traffic, connections, and access between different segments. For this reason, CISA explicitly draws attention to publicly exposed assets and to vulnerabilities that, once exploited, can grant full control of the device. Not all CVEs in the catalog necessarily carry the same consequences, but the US federal directive urges focusing efforts where the impact is greatest.
Binding Operational Directive 26-04, cited by the agency, imposes risk-based vulnerability management requirements on US Federal Civilian Executive Branch agencies. In particular, it reinforces the role of the KEV in remediation planning and requires prioritizing cataloged vulnerabilities that affect exposed assets and allow full control following an exploit. The directive also requires determining, under certain circumstances, whether a system was compromised prior to applying the fix.
The formal requirement applies to Federal Civilian Executive Branch agencies, not Italian or European businesses. However, the operational principle is also applicable outside the federal perimeter: a reliable device inventory, assessing actual exposure, setting priorities, and monitoring for any signs of intrusion are far more useful steps than an indiscriminate rush to remediate every available vulnerability.
For network administrators, the first step is identifying where RouterOS is in use and which devices are accessible from the outside. This is followed by reviewing official MikroTik guidance for the affected versions and configurations, as the CISA advisory lists neither patched releases nor specific workarounds. If remediation requires updates or configuration changes, it should be integrated into a procedure that takes service continuity, backups, and recovery procedures into account.
Updating is not enough: previous exposure must be verified
CISA's directive goes beyond simple remediation. BOD 26-04 includes minimum expectations for determining when potential compromise that occurred prior to patching must be investigated. This is a critical factor, as simply removing the vulnerability does not reconstruct what may have happened while an asset was exposed.
Available sources do not report indicators of compromise, attack signatures, or specific traces to look for regarding these two CVEs. As a result, it is not possible to specify granular technical checks without going beyond known facts. The need remains to involve security and network personnel in evaluating logs, configurations, administrative access, and other available evidence in accordance with internal procedures and vendor guidance.
The addition of these two flaws also comes during a week of rapid updates to the KEV catalog. On September 4, CISA added CVE-2026-85046, a type confusion vulnerability in Google Chromium's V8 engine; on September 8 and 9, two additional advisories were published, each covering four vulnerabilities. This sequence does not establish a link between the flaws or indicate a shared campaign, but it highlights how the catalog is continuously updated as new evidence of exploitation emerges.
For MikroTik and administrators of its devices, the next step will depend on the technical information and mitigations made available by the vendor. CISA will continue to update the KEV when a vulnerability meets the required criteria. In the meantime, CVE-2026-67277 and CVE-2026-86060 should be considered among priority actions: not because the advisory reveals every detail of the attack, but because it confirms that someone is already using them.
