CVE-2026-86060 Elastic Security · Elastic

Detect MikroTik RouterOS Argument Delimiter Injection (CVE-2026-86060) in Elastic Security

Detects exploitation and post-exploitation activity related to CVE-2026-86060, an Improper Neutralization of Argument Delimiters (CWE-88) vulnerability in MikroTik RouterOS. Attacker-controlled input containing embedded argument delimiters (spaces, dashes, control characters) is passed unsanitized into RouterOS command execution, allowing injection of additional command arguments and unauthorized command execution. Listed in CISA KEV (BOD 26-04). Detection focuses on anomalous administrative command invocation, suspicious login/API activity against RouterOS management interfaces (Winbox/API/SSH/WWW), and injected argument patterns in device syslog exported to the SIEM.

MITRE ATT&CK

Tactic
Initial Access Execution Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=10m
  [ network where destination.port in (8291, 8728, 8729, 22, 80, 443) and network.direction == "inbound" ]
  [ any where event.dataset == "system.syslog" and (message : "*login*" or message : "*api*" or message : "*command*") and (message regex~ ".*\\s-{1,2}\\w+.*" or message : "*%2d*") ]
high severity medium confidence

Correlates inbound connections to RouterOS management ports with syslog entries containing injected argument delimiters, indicating CVE-2026-86060 exploitation attempts.

Data Sources

SyslogNetwork flow logs

Required Tables

logs-system.syslog-*logs-network*

False Positives & Tuning

  • Authorized administrative sessions using CLI flags
  • Automated device management platforms
  • Config export/import operations over the API

Other platforms for CVE-2026-86060

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulated RouterOS argument delimiter injection via API (lab)

    Expected signal: RouterOS syslog/API log entry showing a login/command with embedded ' -c' argument delimiter forwarded to the SIEM.

  2. Test 2Injected flag in RouterOS SSH command (lab)

    Expected signal: RouterOS log entry recording a command containing '--' and '--extra=' delimiter patterns.

  3. Test 3URL-encoded delimiter via RouterOS WWW/REST (lab)

    Expected signal: RouterOS WWW/REST access log entry containing the %2d encoded delimiter sequence.

Last updated: 2026-09-11 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the affected MikroTik RouterOS device by hostname/IP and confirm its running RouterOS version against MikroTik advisories for CVE-2026-86060.
  2. Review the source IP(s) issuing the injected commands; determine whether they are from an authorized management subnet or external/untrusted networks.
  3. Examine the full syslog context around the alert for the specific command and injected arguments to understand what action the attacker attempted (user creation, scheduler, fetch, script add).
  4. Check whether management services (Winbox 8291, API 8728/8729, SSH 22, WWW 80/443) are exposed to untrusted networks.

Containment

  1. Restrict access to RouterOS management interfaces to trusted source addresses via firewall address-lists, or take the device off untrusted networks pending patch.
  2. Disable unused management services (Winbox, API, WWW) and rotate all RouterOS admin credentials and API keys.
  3. Upgrade RouterOS to the fixed release identified by MikroTik for CVE-2026-86060.

Evidence Collection

  1. Export the full RouterOS log buffer and any forwarded syslog covering the exploitation window before rebooting or resetting the device.
  2. Capture the current RouterOS configuration export (/export) to identify attacker-added users, scripts, schedulers, or firewall/NAT changes.

Escalation Criteria

  • !Escalate to incident response if attacker-added users, scripts, schedulers, or SOCKS/tunnel configuration are found on the device.
  • !Escalate if the source of the injected commands is an external/untrusted IP or if the same pattern is observed across multiple RouterOS devices.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >RouterOS log buffer and forwarded syslog entries showing command invocations with injected delimiters
  • >RouterOS configuration export (/export) revealing unauthorized users, scripts, schedulers, or firewall rules
  • >Winbox/API/SSH session and authentication logs correlated with the attacker source IP

Tuning Guidance

Baseline your legitimate RouterOS automation sources (NMS, backup jobs, orchestration hosts) and exclude their IPs, then tighten the injection regex to control characters (%2d, \x00) and stacked delimiters to reduce noise from ordinary flag usage. Prioritize alerts where the source IP is outside management subnets and where injected commands touch user, script, scheduler, or fetch operations.

Hunting Queries

Hunts for injected-argument patterns co-occurring with persistence-relevant RouterOS commands (user/scheduler/script add, fetch).

Hunting — KQL
kql 
Syslog | where SyslogMessage matches regex @"(\s-{1,2}\w+|=\S+\s-{1,2}\w+|%2d|\x00)" | where SyslogMessage has_any ("user add", "scheduler add", "script add", "fetch") | project TimeGenerated, Computer, HostIP, SyslogMessage
Hunting — SPL
spl 
index=network (sourcetype="mikrotik:syslog" OR sourcetype="routeros") ("user add" OR "scheduler add" OR "script add" OR fetch) | rex field=_raw "(?<injection>\s-{1,2}\w+|%2d)" | where isnotnull(injection) | table _time host _raw

Atomic Red Team Tests

Test 1 Simulated RouterOS argument delimiter injection via API (lab)
linux

Sends a crafted RouterOS API command containing embedded argument delimiters against an isolated lab RouterOS instance to generate representative telemetry.

Command

bash 
printf '/login\n=name=admin -c "/user add name=hacker password=x group=full"\n' | nc 10.10.10.1 8728

Cleanup

bash 
ssh [email protected] '/user remove hacker' 2>/dev/null || true

Expected Telemetry

RouterOS syslog/API log entry showing a login/command with embedded ' -c' argument delimiter forwarded to the SIEM.

Expected Detection

kql, spl, elastic_eql, qradar_aql, sumo_logic, chronicle_yaral, and crowdstrike_cql rules fire on the injected-argument pattern.

Test 2 Injected flag in RouterOS SSH command (lab)
linux

Issues an SSH-delivered RouterOS command with an appended argument delimiter to a lab device to validate detection of injected flags.

Command

bash 
ssh [email protected] '/system identity set name=router -- --extra=inject'

Cleanup

bash 
ssh [email protected] '/system identity set name=router' 2>/dev/null || true

Expected Telemetry

RouterOS log entry recording a command containing '--' and '--extra=' delimiter patterns.

Expected Detection

Injection-pattern regex matches in all seven SIEM queries; syslog source flagged.

Test 3 URL-encoded delimiter via RouterOS WWW/REST (lab)
linux

Sends a REST/WWW request to a lab RouterOS device with URL-encoded argument delimiters (%2d) to exercise the encoded-delimiter detection path.

Command

bash 
curl -k -u admin:admin 'https://10.10.10.1/rest/system/script/add?name=x%2d%2dsource=inject'

Cleanup

bash 
curl -k -u admin:admin -X DELETE 'https://10.10.10.1/rest/system/script/x' 2>/dev/null || true

Expected Telemetry

RouterOS WWW/REST access log entry containing the %2d encoded delimiter sequence.

Expected Detection

kql, spl, sumo_logic and qradar_aql rules match the %2d encoded-delimiter pattern.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter

Same Tactic: Initial Access

Popular Detections