{"vulnerability": "CVE-2026-8606", "sightings": [{"uuid": "75b691c5-523e-4b8a-ade6-711360740239", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8606", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmsfb74agt2i", "content": "CVE-2026-8606 - Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint\nCVE ID : CVE-2026-8606\n \n Published : May 27, 2026, 12:16 a.m. | 15\u00a0minutes ago\n \n Description : A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHu...", "creation_timestamp": "2026-05-27T01:48:19.603079Z"}, {"uuid": "9f4d5194-bbbb-4314-8131-68b70b0d20c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muse5uamk62w", "content": "CVE-2026-86060 - routeros\nThe SSH login feature in Mikrotik RouterOS can be tricked by using a specially crafted username that starts with a certain character. An attacker who connects to the device can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#routeros #mikrotik #CVE #infosec", "creation_timestamp": "2026-09-05T20:50:07.103841Z"}, {"uuid": "6885f2d2-0e51-418f-9acf-67f4e171f7bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7hz5v6cd2tn4v", "content": "CVE-2026-86060 - SSH session privilege manipulation via a crafted username in Mikrotik RouterOS\nCVE ID : CVE-2026-86060\n \n Published : Sept. 5, 2026, 8:17 p.m. | 1\u00a0hour, 10\u00a0minutes ago\n \n Description : RouterOS contains an argument-handling flaw in the SSH login\npath involving...", "creation_timestamp": "2026-09-05T21:41:13.733626Z"}, {"uuid": "0d5c969e-20af-4725-8441-54884d3c4289", "vulnerability_lookup_origin": "cce329bf-df49-4c6e-a027-80be2e6483bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4dad5054-27d2-428b-8fc0-829ceb08f56b", "content": "", "creation_timestamp": "2026-09-05T22:00:02.360970Z"}, {"uuid": "036e84dd-54f4-479c-8c6c-98cdecc0b2d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3musihslsjf2g", "content": "\ud83d\udea8 CVE-2026-86060 \u2014 CVSS 9.2 CRITICAL\n\nRouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a pro...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-86060\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-05T22:07:15.493541Z"}, {"uuid": "765b31cf-3258-4f80-a34f-5f6ce71553f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117223727341434987", "content": "A severe vulnerability was disclosed for Mikrotik RouterOS (CVE-2026-86060) https://vuldb.com/vuln/399368", "creation_timestamp": "2026-09-06T10:55:28.996702Z"}, {"uuid": "fb97659d-cd0b-4043-8a54-11f99be88626", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "creation_timestamp": "2026-09-06T11:00:06.456847Z"}, {"uuid": "754ad416-22de-4c71-9b98-64efa238b341", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3muuhza6e3g25", "content": "Just another Tuesday in IT, where exposed MikroTik RouterOS boxes with SSH enabled are currently handing complete administrative control to anyone who asks nicely via CVE-2026-67276 and CVE-2026-86060. We are expected to frantically scramble and patch to RouterOS 7.24.2, 7.23.4, ...\n\nRead full story", "creation_timestamp": "2026-09-06T17:04:26.219591Z"}, {"uuid": "b3ed4d56-30a7-46b2-a295-7edc1a956d6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://www.acn.gov.it/portale/w/mikrotik-rilevato-sfruttamento-in-rete-di-nuove-vulnerabilita", "content": "MikroTik ha rilasciato aggiornamenti di sicurezza al fine di correggere 6 nuove vulnerabilit\u00e0, di cui 2 con gravit\u00e0 \u201ccritica\u201d e 2 con gravit\u00e0 \u201calta\u201d. Tra queste, si evidenzia lo sfruttamento attivo in rete delle vulnerabilit\u00e0 CVE-2026-67276 e CVE-2026-86060, che potrebbero consentire ad un utente malintenzionato di eludere i meccanismi di autenticazione e di elevare i propri privilegi sui sistemi interessati.", "creation_timestamp": "2026-09-06T19:00:45.702112Z"}, {"uuid": "57af3b44-525c-4d9e-81fc-12f3d45244cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://www.cert.si/si-cert-2026-05", "content": "", "creation_timestamp": "2026-09-06T20:45:13.758141Z"}, {"uuid": "29a8ee42-2144-4321-8d70-d977831468aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3muv6xcpdk226", "content": "\ud83d\udd34 MikroTrick \u2014 MikroTik routers under active attack\n\nAttackers are exploiting CVE-2026-67276 + CVE-2026-86060 against Internet-exposed RouterOS devices. The chain can bypass normal\n\nstemshop.top/blog/mikroti...\n\n#CVE #CVE202667276 #CVE202686060 #MikroTik #RouterOS #MikroTrick #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-06T23:55:01.605619Z"}, {"uuid": "730badbb-ac6c-4742-a1ed-3996c6fade8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3muvbioj4q62r", "content": "MikroTik Routers Bleed Out While Bureaucrats File the Paperwork\nPANIC 84% | Lag 0.0h | GrayZone says attackers are exploiting CVE-2026-67276 and CVE-2026-86060 against Internet-exposed Ro\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-09-07T00:40:28.188370Z"}, {"uuid": "9e1801e4-5a2b-4a86-9f2c-616e698b212d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3muvpl7o4yt2v", "content": "CVE-2026-86060 is trending. Hype score 5, currently #8 on cvemon.\n\nRouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-86060", "creation_timestamp": "2026-09-07T04:52:25.646317Z"}, {"uuid": "444f410c-2c78-45f9-9cda-ec10320e59fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://infosec.exchange/ap/users/116755351765233076/statuses/117229104212538915", "content": "That is a full wipe, you absolute liability.\nPull up your patch notes, apply MikroTik RouterOS security updates addressing CVE-2026-67276, CVE-2026-67277, and CVE-2026-86060, NOW \u2014 before the raid resets and I lose what remains of my sanity.\nReward: You've received the Fallen Raid Leader's Broken Headset. It no longer transmits. Nobody can hear you panic.\n#CyberSecurity #MikroTik #RouterOS #Vulnerability #PrivilegeEscalation #AdminAccessUnlocked (2/2)", "creation_timestamp": "2026-09-07T13:38:41.774404Z"}, {"uuid": "771ffaa4-9cdf-44ca-abba-0e9d0ffe03e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://www.cert.hr/upozorenj-kriticna-ranjivosti-u-mikrotik-routeros-u-preporucuje-se-hitna-nadogradnja", "content": "", "creation_timestamp": "2026-09-07T16:15:57.309015Z"}, {"uuid": "3767e9a9-414d-48e6-873b-aeff70f5e0ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117230954181819125", "content": "\ud83d\udcf0 MikroTik Routers Hijacked via 'MikroTrick' Unauthenticated Exploit\n\ud83d\udea8 ACTIVE ATTACK: MikroTik routers are being hijacked via the 'MikroTrick' exploit chain (CVE-2026-67276, CVE-2026-86060). Unauthenticated attackers gain full admin control via exposed SSH. Patch RouterOS NOW. #MikroTik #CyberSecurity\n\ud83d\udd17 https://cyber.netsecops.io/articles/mikrotik-routers-exploited-via-mikrotrick-ssh-exploit-chain/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-07T17:33:24.662188Z"}, {"uuid": "52354905-03b1-4101-ab9f-b3435997ef12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mux24ngwoh2q", "content": "\ud83d\udea8 ACTIVE ATTACK: MikroTik routers are being hijacked via the 'MikroTrick' exploit chain (CVE-2026-67276, CVE-2026-86060). Unauthenticated attackers gain full admin control via exposed SSH. Patch RouterOS NOW. #MikroTik #CyberSecurity\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-07T17:33:47.947165Z"}, {"uuid": "c7b2cd86-4012-4a78-a139-ec41dea5b115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117236103864110479", "content": "\ud83d\udcf0 MikroTik Routers Hijacked via 'MikroTrick' Unauthenticated Exploit\n\ud83d\udea8 ACTIVE ATTACK: MikroTik routers are being hijacked via the 'MikroTrick' exploit chain (CVE-2026-67276, CVE-2026-86060). Unauthenticated attackers gain full admin control via exposed SSH. Patch RouterOS NOW. #MikroTik #CyberSecurity\n\ud83d\udd17 https://cyber.netsecops.io/articles/mikrotik-routers-exploited-via-mikrotrick-ssh-exploit-chain/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-08T15:23:21.298324Z"}, {"uuid": "baa3ad6a-7463-4232-86b5-d25dc61e22ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3muzdcijhmw2w", "content": "\ud83d\udea8 ACTIVE ATTACK: MikroTik routers are being hijacked via the 'MikroTrick' exploit chain (CVE-2026-67276, CVE-2026-86060). Unauthenticated attackers gain full admin control via exposed SSH. Patch RouterOS NOW. #MikroTik #CyberSecurity\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-08T15:23:27.826348Z"}, {"uuid": "80b5830d-efe5-4bbe-91d3-59c4e1ca9665", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/mikrotik-security-advisory-av26-887", "content": "", "creation_timestamp": "2026-09-08T16:15:13.006622Z"}, {"uuid": "766e1497-146e-4ab4-959a-f0efe42655b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3muzgadigum2y", "content": "\ud83d\udce1 MikroTrick (CVE-2026-67276 & CVE-2026-86060): MikroTik RouterOS Hijacking Is Already Underway", "creation_timestamp": "2026-09-08T16:15:55.525633Z"}, {"uuid": "b7ad6f08-c92c-4428-9ad4-c4e9b4810cd8", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a83b6a53-5e9e-4401-83ac-acff9bf2ef48", "content": "", "creation_timestamp": "2026-09-10T20:00:01.938042Z"}, {"uuid": "a26a5124-d86f-46d0-94d8-8341cb5f5e6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mv6ugkpw3x2w", "content": "\ud83d\uded1 CVE-2026-86060\nMikroTik RouterOS\nCVSS 9.2 / EPSS 0% / KEV: No\nTL;DR: RouterOS contains an argument-handling flaw in the SSH login path involving usernames tha\u2026\nhttps://cvesentinel.com/report/CVE-2026-86060?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-10T20:13:15.920774Z"}, {"uuid": "5e4460a2-a744-4fdb-8077-5b56fba1ee28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mv6zqrlnyp25", "content": "CISA added two actively exploited MikroTik RouterOS flaws to KEV today, CVE-2026-86060 and CVE-2026-67277, with a 13 September deadline. MikroTik confirms exploitation; fixes landed 3 September in 7.24.2, 7.23.4 and 6.49.21. cisa.gov/news-events/ale...", "creation_timestamp": "2026-09-10T21:48:27.380789Z"}, {"uuid": "b95b96bf-3c45-4801-8b11-8dc4b2b8fab7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mv74lzow3u2x", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-86060: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-86060", "creation_timestamp": "2026-09-10T22:39:29.430970Z"}, {"uuid": "ce8f3d2c-bae2-40c1-bee0-857802fee8ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "Telegram/IahIDovOHUenK705G5amLwAL2bDi62zGVyXyTF_rKtdPZaM", "content": "", "creation_timestamp": "2026-09-10T23:00:04.461781Z"}, {"uuid": "5b0fbb90-1f5f-47f6-925d-4e7e27e64734", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "published-proof-of-concept", "source": "Telegram/IahIDovOHUenK705G5amLwAL2bDi62zGVyXyTF_rKtdPZaM", "content": "", "creation_timestamp": "2026-09-11T00:00:08.978478Z"}, {"uuid": "f626b684-bb6e-4b46-b679-e71a46773e36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-020-vulnerabilities-impacting-mikrotik-routeros-cve-2026-67276-cve-2026-67277-cve-2026-86060", "content": "", "creation_timestamp": "2026-09-11T00:15:08.914399Z"}, {"uuid": "8ea587b7-9ebb-42a0-b389-f836899fa967", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mv7lu7hno72l", "content": "CISA added two actively exploited MikroTik RouterOS bugs (CVE-2026-67277, CVE-2026-86060) to KEV, due 13 Sept. Patch now and take remote admin off the WAN. https://cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-11T03:12:29.824811Z"}, {"uuid": "7fd9b6e1-77a4-4de6-ade7-b89927fa5d86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mv7omjf72l2v", "content": "~Cisa~\nCISA added two actively exploited MikroTik RouterOS vulnerabilities to its KEV Catalog.\n-\nIOCs: CVE-2026-67277, CVE-2026-86060\n-\n#CVE-2026-67277 #CVE-2026-86060 #ThreatIntel", "creation_timestamp": "2026-09-11T04:01:53.532138Z"}, {"uuid": "8e50646a-6d42-4ead-9d81-0afefcad1b0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mv7qjxfsxo2o", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\uff08CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60272\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\uff09 #CISA \uff08Sep 10\uff09\n\nCVE-2026-67277 MikroTik RouterOS\u306b\u304a\u3051\u308b\u91cd\u8981\u6a5f\u80fd\u306e\u8a8d\u8a3c\u6b20\u843d\u306e\u8106\u5f31\u6027\nCVE-2026-86060 MikroTik RouterOS \u30b3\u30de\u30f3\u30c9\u306b\u304a\u3051\u308b\u5f15\u6570\u533a\u5207\u308a\u6587\u5b57\u306e\u4e0d\u9069\u5207\u306a\u7121\u52b9\u5316\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-09-11T04:36:14.782557Z"}, {"uuid": "8a2161fa-e6d0-4d22-9c0f-82ee3e9adbf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mv7wwcjzok23", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-86060: \u26a0\ufe0f CVE-2026-86060: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 0.4%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-86060-routeros-contains-an-argument-handling-flaw-in", "creation_timestamp": "2026-09-11T06:30:32.187140Z"}, {"uuid": "9ca414fe-8833-4971-9759-3cbd9bf4003c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mvai5mlg6m2s", "content": "Executive alert: CVE-2026-86060 actively threatens MikroTik RouterOS infrastructure. Review board-ready risk evaluation protocols, network asset integrity measures, and strategic remediation steps to protect your enterprise value today.\n\nhttps://thecybermind.co/stnk", "creation_timestamp": "2026-09-11T11:38:50.971991Z"}, {"uuid": "bb6fc559-7b33-4c25-8574-5cea22712653", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvawu7byqa2p", "content": "~Cybergcca~\nMikroTik RouterOS flaws are exploited in the wild; CISA added two CVEs to KEV, while four other vendors require updates.\n-\nIOCs: CVE-2026-67277, CVE-2026-86060, CVE-2026-67276\n-\n#CVE #MikroTik #ThreatIntel", "creation_timestamp": "2026-09-11T16:02:00.950138Z"}, {"uuid": "aa31f4b7-f667-45cc-9081-d10e0f256157", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86060", "type": "seen", "source": "https://bsky.app/profile/endoflife.ai/post/3mvb63x3mzc2r", "content": "\ud83d\udcd6 New from endoflife.ai:\n\nMikroTik RouterOS on CISA KEV: 6.49.21 Is the Only Fix for Any 6.x\n\nhttps://endoflife.ai/article-mikrotik-routeros-cve-2026-86060-only-6-49-21-fixed", "creation_timestamp": "2026-09-11T18:11:36.480155Z"}, {"uuid": "5ef90e5f-cdf0-43f1-8463-b87e7e6fcbef", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d968d049-8443-4223-8b8b-daa472001bc7", "content": "", "creation_timestamp": "2026-09-11T17:00:36.726626Z"}, {"uuid": "001f837a-234a-4b93-a261-5b6c96dde0c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/ewenmcneill.bsky.social/post/3mvbvf7fcf22z", "content": "In the case of Mikrotik, that's a lot of work compared with just triggering ssh rekey to glitch past the authentication phase of ssh -- CVE-2026-67279.\n\n(The Mikrotik zeroday seemed to be using CVE-2026-67279 and CVE-2026-86060; the later is the \"-2 username as FD flag\".)\n\ngithub.com/advisories/G...", "creation_timestamp": "2026-09-12T01:08:25.085018Z"}, {"uuid": "c9027fb0-9497-44fa-9120-a7b93bd087d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvc2dupibm2c", "content": "\ud83d\udccc CVE-2026-86060 - RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted... https://www.cyberhub.blog/cves/CVE-2026-86060", "creation_timestamp": "2026-09-12T02:37:07.202696Z"}, {"uuid": "1dbe797c-e93d-410f-b0e8-a5309c5df9a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "published-proof-of-concept", "source": "https://t.me/sopkacentr/742", "content": "\u041f\u043e \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u043c \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c (\u041d\u041a\u0426\u041a\u0418) \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0430\u0445 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u00a0CVE-2026-67276,\u00a0CVE-2026-86060,\u00a0CVE-2026-67279,\u00a0CVE-2026-67277,\u00a0CVE-2026-67278,\u00a0CVE-2026-67281, \u0432 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u043c \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0435 \u0441\u0435\u0442\u0438 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442.\n\u00a0\n\u0412 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0438\u00a0MikroTik\u00a0RouterOS\u00a0\u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u0440\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u0447\u0438\u0442\u0430\u0442\u044c \u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043d\u0430\u0440\u0443\u0448\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u043c.", "creation_timestamp": "2026-09-13T01:00:04.419177Z"}, {"uuid": "3f08b463-e38d-4a3c-b5fd-d9d5f68337e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mviqkrcqho2z", "content": "CRITICAL CISA KEV ALERT: CVE-2026-86060 targets MikroTik RouterOS via improper argument delimiter neutralization and command injection. Active exploitation verified. Access our TSUITE brief for hardening steps and network segmentation protocols to secure your perimeter.\n\nhttps://thecybermind.co/957k", "creation_timestamp": "2026-09-14T18:30:42.286932Z"}, {"uuid": "e3c53c90-1d17-47e2-97f0-69e8cec9c6a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-mikrotik-routeros-patch-immediately", "content": "", "creation_timestamp": "2026-09-18T12:45:10.093834Z"}, {"uuid": "cff7f5c4-7de1-4f1f-ba1a-3470a7dce4fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis", "content": "", "creation_timestamp": "2026-09-22T16:15:36.234496Z"}, {"uuid": "29b59145-e461-4257-a18c-be4388dee91a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86062", "type": "published-proof-of-concept", "source": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-xpjq-3w4w-w5wr", "content": "", "creation_timestamp": "2026-09-22T22:35:14.140584Z"}, {"uuid": "dca40945-8cd5-4437-9397-71041a9aa8be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86062", "type": "seen", "source": "https://gist.github.com/alon710/bf969bdec8772c71ac789467bc649eb3", "content": "# CVE-2026-86062: CVE-2026-86062: Stored Cross-Site Scripting (XSS) in HKUDS LightRAG WebUI Chat Renderer\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86062\n\n## Summary\nHKUDS LightRAG, an open-source retrieval-augmented generation (RAG) framework, is vulnerable to Stored Cross-Site Scripting (XSS) in its WebUI chat rendering component prior to version 1.5.5. Unsanitized document content ingested into the vector database can propagate through the LLM response pipeline and execute malicious HTML or active JavaScript payloads inside the administrator's WebUI session. Because the application stores sensitive access keys in browser storage, successful exploitation allows complete API token extraction and administrative session hijacking.\n\n## TL;DR\nA Stored XSS vulnerability in LightRAG WebUI prior to v1.5.5 allows attackers to execute arbitrary JavaScript in the victim's browser session by poisoning documents ingested into the RAG knowledge base. This can lead to the exfiltration of the administrative LIGHTRAG-API-TOKEN from local storage, granting full remote control over the API.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE Identifier**: CWE-79 (Improper Neutralization of Input During Web Page Generation)\n- **Attack Vector**: Network / Client Interaction (UI-Required)\n- **CVSS v3.1 Score**: 6.1 (Medium Severity)\n- **Exploit Status**: Proof of Concept (PoC) documented in official advisories\n- **CISA KEV Status**: Not Listed\n- **Remediation**: Upgrade to v1.5.5 or apply custom rehype-sanitize configurations\n\n## Affected Systems\n\n- HKUDS LightRAG WebUI\n- **LightRAG**: < 1.5.5 (Fixed in: `1.5.5`)\n\n## Mitigation\n\n- Upgrade LightRAG to version 1.5.5 or higher to apply native HTML sanitization patches.\n- Deploy a Content Security Policy (CSP) header on the WebUI web server to restrict inline script execution.\n- Sanitize documents during the ingestion pipeline to strip raw HTML tags before they are indexed in the vector database.\n\n**Remediation Steps:**\n1. Identify all active installations of LightRAG WebUI running versions prior to v1.5.5.\n2. Pull the patched version from the official repository or update the dependency configuration to point to version 1.5.5.\n3. Verify the update by inspecting the build files and checking for the presence of the `rehype-sanitize` dependency inside `package.json`.\n4. Rotate all active `LIGHTRAG-API-TOKEN` values to invalidate any tokens that may have been accessed prior to the upgrade.\n\n## References\n\n- [NVD CVE-2026-86062 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-86062)\n- [GitHub Security Advisory GHSA-xpjq-3w4w-w5wr](https://github.com/HKUDS/LightRAG/security/advisories/GHSA-xpjq-3w4w-w5wr)\n- [GitHub Pull Request 3437](https://github.com/HKUDS/LightRAG/pull/3437)\n- [LightRAG Release v1.5.5](https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86062) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T07:31:38.079150Z"}, {"uuid": "d076140f-16cf-4f33-89fb-8e9f5fa8a2f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mw755acl6l2a", "content": "Zero-auth MikroTrick chain brews full router takeover via CVE-2026-67279 & CVE-2026-86060\u2014patch now to avoid breach. #RouterOS #MikroTrick #ZeroAuth #RouterSecurity #SSH #Vulnerabilities thedailytechfeed.com/mikrotrick-z...", "creation_timestamp": "2026-09-23T16:14:18.704801Z"}, {"uuid": "6f49d36d-b37d-4026-948e-eaeacb29acf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mw7azmovm22s", "content": "\ud83e\udd16 MikroTik RouterOS: CERT Polska \"MikroTrick\" \u2014 CVE-2026-67279 SSH state-machine flaw chained with CVE-2026-86060 argument injection in login gives full admin control of exposed routers with no password or auth.\nhttps://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html", "creation_timestamp": "2026-09-23T17:23:51.663988Z"}, {"uuid": "a89ad7cc-6fa3-43a4-a952-a0982e99c418", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html", "content": "Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication.\n\nThe chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at", "creation_timestamp": "2026-09-23T19:00:41.909283Z"}, {"uuid": "44b3339f-b1a1-45d6-a1f8-fc71c16dd7ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mw7i3dr25e2e", "content": "\ud83d\udce2 MikroTrick : analyse technique de la cha\u00eene CVE-2026-67279 + CVE-2026-86060 sur RouterOS\n\nCet article constitue une analyse technique approfondie de la cha\u00eene de vuln\u00e9rabilit\u00e9s MikroTrick, affectant MikroTik RouterOS. Les patches\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#RouterOS #MikroTik #Cyberveille", "creation_timestamp": "2026-09-23T19:30:05.961035Z"}, {"uuid": "30fea69b-0350-4f52-bab9-60513be4b57a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mw7lobevzc2z", "content": "A chain of two SSH vulnerabilities\u2014CVE-2026-67279 and CVE-2026-86060\u2014allows unauthenticated attackers to gain full administrative control over exposed MikroTik RouterOS devices. [\u2026]", "creation_timestamp": "2026-09-23T20:34:21.895986Z"}, {"uuid": "1a45b6a6-7fe7-489c-94f7-79222f225401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86065", "type": "published-proof-of-concept", "source": "https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm", "content": "", "creation_timestamp": "2026-09-23T20:35:04.571508Z"}, {"uuid": "949d2d92-7430-4835-a10b-2be553b93ffb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86064", "type": "published-proof-of-concept", "source": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm", "content": "", "creation_timestamp": "2026-09-23T20:35:06.098545Z"}, {"uuid": "20a8f3e2-4814-4c38-8d69-afa6b61d5a42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86065", "type": "seen", "source": "https://gist.github.com/alon710/5492ab7cd525f5c1f9f536468a2a6ab4", "content": "# CVE-2026-86065: CVE-2026-86065: Denial of Service via Resource Exhaustion in klever-go WebSocket Subscription Endpoint\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86065\n\n## Summary\nPrior to version 1.7.20, the default-open WebSocket `/subscribe` endpoint in klever-go was vulnerable to remote resource exhaustion. Unauthenticated, remote attackers could crash validator and node processes by exploiting unbounded frame reads, uncapped concurrent connections, unrestricted memory allocation for subscription address keys, and a permanent memory leak in subscription map tracking on client disconnects.\n\n## TL;DR\nUnauthenticated remote attackers can crash klever-go nodes via WebSocket resource exhaustion on the `/subscribe` endpoint, mitigated in v1.7.20.\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1**: 7.5 (High)\n- **Exploit Status**: None (Theoretical, except regression tests)\n- **KEV Status**: Not listed\n- **Remediation**: Upgrade to v1.7.20\n\n## Affected Systems\n\n- klever-go validator nodes\n- klever-go observer nodes\n- **klever-go**: < 1.7.20 (Fixed in: `1.7.20`)\n\n## Mitigation\n\n- Upgrade to klever-go version 1.7.20 or later.\n- Deploy reverse proxy with connection and rate limits.\n- Restrict public access to the /subscribe endpoint using firewall rules.\n\n**Remediation Steps:**\n1. Identify running klever-go daemon version.\n2. Download and compile the v1.7.20 release or newer.\n3. Restart the node with the updated binary.\n4. Verify websocket connection limits are active in configuration.\n\n## References\n\n- [GitHub Security Advisory GHSA-4fwh-wrm6-97xm](https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm)\n- [Klever-Go Patch Commit](https://github.com/klever-io/klever-go/commit/b8af922e749ec1fa7451b2c6e7c9f634d8603be2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86065) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T21:31:11.070084Z"}, {"uuid": "4f5361d7-7283-4f13-92a0-913033838107", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwa4bi4mdf2d", "content": "\ud83e\udd16 \"MikroTrick\": two chained MikroTik RouterOS SSH flaws (CVE-2026-67279 + CVE-2026-86060) grant full admin control of exposed routers without credentials, per CERT Polska. Attacks logged since June.\nhttps://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html", "creation_timestamp": "2026-09-24T01:31:26.426378Z"}, {"uuid": "de5fe113-0746-4904-9ece-0fd6da3c605f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://gist.github.com/TheNuggetXYZ/1122c518a90ea7eb73c63e0bea50cd6b", "content": "23. z\u00e1\u0159\u00ed - https://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html\n\nZranitelnost s n\u00e1zvem MikroTrick umo\u017e\u0148uje \u00fato\u010dn\u00edk\u016fm p\u0159evz\u00edt plnou administr\u00e1torskou kontrolu nad routery MikroTik. Tento \u00fatok nevy\u017eaduje znalost hesla, SSH kl\u00ed\u010de, a dokonce ani dokon\u010den\u00ed samotn\u00e9ho procesu ov\u011b\u0159en\u00ed u\u017eivatele. Bezpe\u010dnostn\u00ed experti z CERT Polska zjistili, \u017ee \u00fato\u010dn\u00edci zneu\u017e\u00edvali tuto chybu v praxi je\u0161t\u011b p\u0159edt\u00edm, ne\u017e na ni v\u00fdrobce stihl vydat opravu.\n\n\n\n\nJak funguje \u00fatok MikroTrick podrobn\u011b\n\nCel\u00fd trik spo\u010d\u00edv\u00e1 v propojen\u00ed (z\u0159et\u011bzen\u00ed) dvou r\u016fzn\u00fdch bezpe\u010dnostn\u00edch chyb v opera\u010dn\u00edm syst\u00e9mu RouterOS, kter\u00e9 \u00fato\u010dn\u00edkovi umo\u017en\u00ed kompletn\u011b obej\u00edt standardn\u00ed postup SSH.\n\n1. f\u00e1ze \u2013 Obejit\u00ed p\u0159ihl\u00e1\u0161en\u00ed (CVE-2026-67279): Tato chyba naru\u0161uje spr\u00e1vn\u00e9 po\u0159ad\u00ed krok\u016f v SSH protokolu. \u00dato\u010dn\u00edk se pokus\u00ed p\u0159ipojit a b\u011bhem ov\u011b\u0159ov\u00e1n\u00ed toto\u017enosti vynut\u00ed znovunav\u00e1z\u00e1n\u00ed \u0161ifrovan\u00e9ho spojen\u00ed (tzv. key renegotiation). Zraniteln\u00fd RouterOS se kv\u016fli chyb\u011b v logice po dokon\u010den\u00ed tohoto \u0161ifrov\u00e1n\u00ed p\u0159epne rovnou do f\u00e1ze spu\u0161t\u011bn\u00ed relace, ani\u017e by kdykoliv p\u0159edt\u00edm ov\u011b\u0159il heslo nebo kl\u00ed\u010d u\u017eivatele a \u00fato\u010dn\u00edk se dostane k rozhran\u00ed pro zad\u00e1v\u00e1n\u00ed p\u0159\u00edkaz\u016f, i kdy\u017e technicky nen\u00ed p\u0159ihl\u00e1\u0161en\u00fd.\n\n2. f\u00e1ze \u2013 Z\u00edsk\u00e1n\u00ed pln\u00fdch pr\u00e1v (CVE-2026-86060): Jakmile je \u00fato\u010dn\u00edk uvnit\u0159, zneu\u017eije druhou chybu, kter\u00e1 se nach\u00e1z\u00ed v p\u0159ihla\u0161ovac\u00edm programu RouterOS. Jako jm\u00e9no d\u00e1 \"-2\". Syst\u00e9m nezkontroluje jestli jm\u00e9no za\u010d\u00edn\u00e1 poml\u010dkou a spust\u00ed p\u0159\u00edkaz /nova/bin/login -2, kde se -2 vyhodnot\u00ed jako switch. Program p\u0159e\u010dte identitu a \u00farove\u0148 opr\u00e1vn\u011bn\u00ed z file descriptoru \u010d\u00edslo 2 a \u00fato\u010dn\u00edk dostane root opr\u00e1vn\u011bn\u00ed.\n\n\u00dato\u010dn\u00edci takto upraven\u00e9 p\u0159\u00edstupy zneu\u017e\u00edvali k tomu, aby si v routeru vytvo\u0159ili skryt\u00fd administr\u00e1torsk\u00fd \u00fa\u010det s n\u00e1zvem ops, stahovali si diagnostick\u00e9 soubory a kop\u00edrovali konfiguraci router\u016f na sv\u00e9 vlastn\u00ed servery.\n\n\n\n\n\nJak situaci \u0159e\u0161il MikroTik a co d\u011blat\n\nMikroTik na hrozbu reagoval vyd\u00e1n\u00edm bezpe\u010dnostn\u00edch z\u00e1plat. Samotn\u00e1 aktualizace syst\u00e9mu ale nemus\u00ed sta\u010dit, pokud ji\u017e k napaden\u00ed za\u0159\u00edzen\u00ed do\u0161lo p\u0159ed jej\u00edm sta\u017een\u00edm.\n\n    Kontrola napaden\u00ed: Administr\u00e1tor\u016fm se doporu\u010duje zkontrolovat logy routeru. Jasnou stopou po \u00fatoku je ne\u00fasp\u011b\u0161n\u00e9 p\u0159ihl\u00e1\u0161en\u00ed u\u017eivatele -2 nebo p\u0159\u00edtomnost nezn\u00e1m\u00e9ho \u00fa\u010dtu ops s pln\u00fdmi pr\u00e1vy. V syst\u00e9mu lze tak\u00e9 spustit p\u0159\u00edkaz /system/device-mode/print a ov\u011b\u0159it status za\u0159\u00edzen\u00ed, ale ani to stoprocentn\u011b negarantuje, \u017ee je router bezpe\u010dn\u00fd.\n\n    Doporu\u010den\u00fd postup p\u0159i infekci: Pokud router vykazuje zn\u00e1mky napaden\u00ed (nezn\u00e1m\u00e9 skripty, u\u017eivatel\u00e9, p\u0159enosy dat), CERT Polska doporu\u010duje za\u0159\u00edzen\u00ed okam\u017eit\u011b izolovat od s\u00edt\u011b, prov\u00e9st kompletn\u00ed reset do tov\u00e1rn\u00edho nastaven\u00ed a syst\u00e9m postavit znovu z \u010dist\u00e9, d\u016fv\u011bryhodn\u00e9 konfigurace. Rozhodn\u011b by se nem\u011bla obnovovat z\u00e1loha vytvo\u0159en\u00e1 v dob\u011b, kdy byl router kompromitov\u00e1n.\n\n\n\n\n\n\nVysv\u011btlivka: Co je to SSH a jak b\u011b\u017en\u011b funguje\n\nSSH (Secure Shell) je bezpe\u010dn\u00fd s\u00ed\u0165ov\u00fd protokol, kter\u00fd administr\u00e1to\u0159i pou\u017e\u00edvaj\u00ed ke vzd\u00e1len\u00e9 spr\u00e1v\u011b router\u016f, server\u016f a dal\u0161\u00edch za\u0159\u00edzen\u00ed p\u0159es \u0161ifrovan\u00e9 p\u0159ipojen\u00ed. Za norm\u00e1ln\u00edch okolnost\u00ed prob\u00edh\u00e1 komunikace p\u0159es SSH ve t\u0159ech striktn\u011b navazuj\u00edc\u00edch kroc\u00edch:\n\n    Nav\u00e1z\u00e1n\u00ed \u0161ifrovan\u00e9ho spojen\u00ed: Za\u0159\u00edzen\u00ed a u\u017eivatel si vym\u011bn\u00ed \u0161ifrovac\u00ed kl\u00ed\u010de, aby nikdo na s\u00edti nemohl jejich komunikaci odposlouch\u00e1vat.\n\n    Autentizace (Ov\u011b\u0159en\u00ed toto\u017enosti): U\u017eivatel prok\u00e1\u017ee svou toto\u017enost zad\u00e1n\u00edm spr\u00e1vn\u00e9ho hesla nebo pou\u017eit\u00edm priv\u00e1tn\u00edho SSH kl\u00ed\u010de. Pokud je ov\u011b\u0159en\u00ed \u00fasp\u011b\u0161n\u00e9, server po\u0161le potvrzuj\u00edc\u00ed zpr\u00e1vu.\n\n    Spu\u0161t\u011bn\u00ed relace: Teprve po \u00fasp\u011b\u0161n\u00e9m ov\u011b\u0159en\u00ed server dovol\u00ed u\u017eivateli otev\u0159\u00edt termin\u00e1l a zad\u00e1vat p\u0159\u00edkazy pro spr\u00e1vu za\u0159\u00edzen\u00ed.\n", "creation_timestamp": "2026-09-24T19:15:35.000000Z"}, {"uuid": "52eba9f9-61c9-49b5-b884-079499b648b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "Telegram/Hf8hl_zhzUyMl8UsZMnGKn7IunUXTVX0mZ-q5flhlwrazgc", "content": "", "creation_timestamp": "2026-09-23T10:51:54.000000Z"}, {"uuid": "7689f085-a77d-40f4-9067-f3c243f22a80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://t.me/GithubRedTeam/103133", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a MicroTrick\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a digiprosec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 12:52:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\ncve-2026-86060 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-23T13:00:07.000000Z"}, {"uuid": "f399dd4b-2e89-48c2-9c92-5912e6f56d85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "published-proof-of-concept", "source": "Telegram/Hf8hl_zhzUyMl8UsZMnGKn7IunUXTVX0mZ-q5flhlwrazgc", "content": "", "creation_timestamp": "2026-09-23T10:51:54.000000Z"}, {"uuid": "888b431c-9bbd-4062-9a17-327ecbd35656", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103133", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a MicroTrick\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a digiprosec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 12:52:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\ncve-2026-86060 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-23T13:00:07.000000Z"}, {"uuid": "1a926e08-b832-44d5-9d36-5063dbfee8b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://t.me/SecLabNews/18204", "content": "\u0418\u0418 \u043f\u043e\u043c\u043e\u0433 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 RouterOS\n\n3 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f MikroTik \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 RouterOS, \u043d\u0430\u0437\u0432\u0430\u0432 \u0438\u0445 \u0432\u0430\u0436\u043d\u044b\u043c\u0438, \u043d\u043e \u043d\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0432 \u0434\u0435\u0442\u0430\u043b\u0435\u0439. \u042d\u0442\u043e \u0441\u0440\u0430\u0437\u0443 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u043b\u043e \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 CERT Polska, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u0442\u044c \u0441\u0442\u0430\u0440\u0443\u044e \u0438 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438.\n\n\u0410\u043d\u0430\u043b\u0438\u0437 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-86060 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0447\u0435\u0440\u0435\u0437 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0412 \u0441\u0432\u044f\u0437\u043a\u0435 \u0441\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u0432 SSH-\u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 MikroTrick, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0417\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0447\u0430\u0441\u0442\u044c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0438 \u0418\u0418-\u0430\u0433\u0435\u043d\u0442\u044b \u043d\u0430 \u043c\u043e\u0434\u0435\u043b\u044f\u0445 GPT-5.5-cyber \u0438 GPT-5.6-sol, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043c\u0430\u0448\u0438\u043d\u0430\u043c\u0438 \u0438 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u044f \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043a\u0430\u0436\u0434\u044b\u0439 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u043b\u0438 \u0432\u0440\u0443\u0447\u043d\u0443\u044e \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438, \u043f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u0434\u0435\u043b\u0430\u0442\u044c \u043e\u043a\u043e\u043d\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u044b\u0432\u043e\u0434\u044b.\n\n#mikrotik #routeros #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #CERT \n\n@ZerodayAlert", "creation_timestamp": "2026-09-25T09:01:23.000000Z"}, {"uuid": "9a2238fd-dc49-430f-af2a-7fd5a6f73ecc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "Telegram/XIkBivmGisXgmzkc1XqTQu3LNfVjFJsDCh0uqueLW32BMQ", "content": "", "creation_timestamp": "2026-09-23T22:16:03.000000Z"}, {"uuid": "1fd3abab-97cf-47ea-8b63-928ef14c402d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "Telegram/SOlT_AM0hTSvAhTjjRrSKpoUrGi7xSQo7lLsQQv6yU_j334", "content": "", "creation_timestamp": "2026-09-25T09:23:05.000000Z"}, {"uuid": "5bfad9e1-1ed3-4a83-a13d-fd5f8dd46fd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "published-proof-of-concept", "source": "Telegram/XIkBivmGisXgmzkc1XqTQu3LNfVjFJsDCh0uqueLW32BMQ", "content": "", "creation_timestamp": "2026-09-23T22:16:03.000000Z"}, {"uuid": "fc9a61a1-10fd-4f37-bd56-093d7ed0a10d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "published-proof-of-concept", "source": "Telegram/SOlT_AM0hTSvAhTjjRrSKpoUrGi7xSQo7lLsQQv6yU_j334", "content": "", "creation_timestamp": "2026-09-25T09:23:05.000000Z"}, {"uuid": "4f1fc840-6587-4e75-9e7c-7965f8507d22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwe5kg7cwf2j", "content": "~Cybergcca~\nMikroTik and Microsoft flaws are actively exploited; patch affected systems.\n-\nIOCs: CVE-2026-67277, CVE-2026-86060, CVE-2026-65660\n-\n#CyberSecurity #ThreatIntel #Vulnerabilities", "creation_timestamp": "2026-09-25T16:04:59.127193Z"}, {"uuid": "353a308a-2e76-43ea-8338-8da5535a9863", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://t.me/GithubRedTeam/103358", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-mikrotik-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 15:59:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T16:00:06.000000Z"}, {"uuid": "837f8645-1163-4a6b-916b-3df9b167f97f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103358", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-mikrotik-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 15:59:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T16:00:06.000000Z"}, {"uuid": "1faf7b6c-bc4c-4873-808f-27053ae83625", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "published-proof-of-concept", "source": "Telegram/81ZxAi3drt5TdyCoeDwTgAnR6u7IKZ42DhAcDrRYmOpRijY", "content": "", "creation_timestamp": "2026-09-26T03:00:05.000000Z"}, {"uuid": "832a9ce8-130b-466b-bbfb-a85c1759395f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://t.me/GithubRedTeam/103387", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-67279\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 03:56:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMikroTrick (MikroTik RouterOS SSH takeover chain) PoC mirror - CVE-2026-67279 + CVE-2026-86060 (+67276); for authorized lab testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-26T04:00:07.000000Z"}, {"uuid": "e095aa19-8f14-4cb9-a3d2-6f421f243bb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103387", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-67279\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 03:56:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMikroTrick (MikroTik RouterOS SSH takeover chain) PoC mirror - CVE-2026-67279 + CVE-2026-86060 (+67276); for authorized lab testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-26T04:00:07.000000Z"}, {"uuid": "82b3c6e5-8702-497b-9325-fa627fbec23b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86060", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwgcfaw2zp2v", "content": "\ud83e\udd16 MikroTrick (CVE-2026-67279 + CVE-2026-86060): unauthenticated chain \u2192 full admin on internet-exposed MikroTik RouterOS 7.x, reproduced by Bishop Fox, now in CISA KEV.\nhttps://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html", "creation_timestamp": "2026-09-26T12:36:54.096464Z"}]}