Advisories
CISA Expands KEV Catalog with Two New MikroTik RouterOS Vulnerabilities
CISA has added CVE‑2026‑67277 and CVE‑2026‑86060 to its Known Exploited Vulnerabilities catalog after confirming active attacks. The flaws let attackers bypass authentication and inject malicious commands on MikroTik RouterOS devices, giving full control. Federal agencies are urged to patch immediately under BOD 26‑04, which prioritizes remediation of high‑risk KEVs on publicly exposed assets. All organizations are encouraged to adopt a risk‑based approach and can submit new KEVs for consideration via CISA’s nomination form.
In a move that tightens the federal security posture, CISA has broadened its Known Exploited Vulnerabilities (KEV) catalog by adding two new MikroTik RouterOS flaws. Both vulnerabilities—CVE‑2026‑67277 (missing authentication for a critical function) and CVE‑2026‑86060 (improper neutralization of argument delimiters)—have been proven in the wild and can grant attackers full control of affected routers.
What the Additions Mean for Federal Agencies
- Under Binding Operational Directive 26‑04, federal civilian executive branch (FCEB) agencies must prioritize rapid patching of KEVs that expose publicly reachable assets.
- The directive stresses that agencies check for compromise before applying a fix and defer lower‑risk vulnerabilities.
- While the mandate applies to FCEB, CISA urges all organizations to follow a risk‑based remediation strategy.
Next Steps for All Organizations
- Verify if your MikroTik devices are running vulnerable RouterOS versions.
- Apply the latest security updates immediately.
- Monitor for signs of exploitation and conduct post‑patch vulnerability scans.
- Consider submitting other actively exploited CVEs to the KEV catalog via CISA’s nomination form.
“CISA will continue to add vulnerabilities that meet the criteria of active exploitation, a CVE ID, and clear mitigation guidance,” the agency noted.
Related vulnerabilities
CISA Expands KEV Catalog with Two New MikroTik RouterOS Exploits
CISA has added two actively exploited vulnerabilities that target MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog. CVE‑2026‑67277 allows attackers to bypass authentication for a critical function, while CVE‑2026‑86060 lets them inject malicious commands by exploiting improper argument neutralization. The update reinforces federal guidance under BOD 26‑04 to prioritize rapid patching of high‑risk flaws on publicly exposed assets, and invites all organizations to adopt a risk‑based approach to remediation.
Read briefing
CISA Expands KEV Catalog with Four New Exploited Vulnerabilities
CISA has added four new CVEs to its Known Exploited Vulnerabilities catalog, covering critical flaws in Adobe Commerce, Microsoft Windows, and N‑central. The update highlights the agency’s push for rapid remediation of high‑risk flaws and reinforces BOD 26‑04’s prioritization rules for federal agencies.
Read briefing
CISA Expands KEV Catalog with Four Fresh Exploited Vulnerabilities
The Cybersecurity and Infrastructure Security Agency has added four new CVEs to its Known Exploited Vulnerabilities catalog, covering a critical Adobe Commerce flaw, two Microsoft Windows weaknesses, and a N‑able N‑central code injection. The update reinforces BOD 26‑04’s risk‑based patching mandate for federal agencies and urges all organizations to prioritize these high‑risk fixes and submit any other exploited CVEs for consideration.
Read briefing
CISA Expands KEV Catalog with Three Fresh Exploited JFrog and ConnectWise Flaws
CISA has added three new CVEs to its Known Exploited Vulnerabilities catalog, spotlighting serious authorization lapses in JFrog Artifactory and ConnectWise ScreenConnect. The update underscores the agency’s Binding Operational Directive 26‑04, which mandates rapid patching of high‑risk flaws on publicly exposed federal assets. All organizations are urged to adopt risk‑based remediation and can submit unlisted exploited vulnerabilities via CISA’s nomination form.
Read briefing