October 8, 2026 · 1 min read
RouterOS in CISA’s KEV Catalog: Prioritize Exploitation Evidence
CISA’s September RouterOS additions show why confirmed exploitation should influence patch priority alongside severity and exposure.
What changed
On September 10, 2026, CISA added two MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation:
- CVE-2026-67277: missing authentication for a critical function.
- CVE-2026-86060: improper handling of argument delimiters in a command.
The bulletin establishes exploitation evidence; it does not establish that every RouterOS deployment is affected or compromised.
Practical takeaway
My recommendation: combine exploitation evidence, internet exposure and business impact when prioritizing remediation. A router that carries production traffic deserves more than a position in a generic patch queue.
- Inventory RouterOS devices and identify their exact software versions.
- Consult current MikroTik guidance to determine affected builds and remediation.
- Restrict management access to trusted networks and review unexpected configuration changes.
- Record patch verification separately from incident investigation. Updating a device does not prove that earlier compromise never occurred.
CISA’s federal requirements have a defined agency scope; other organizations can still use KEV as a risk-prioritization input.
Source
CISA bulletin — September 10, 2026
Advisory date: September 10, 2026. Commentary published October 8, 2026.