{"type":"bundle","id":"bundle--05fa9f87-41c4-5856-9cc0-914978e64944","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"vulnerability","spec_version":"2.1","id":"vulnerability--ebacf3f2-8731-5dd9-bb73-c9ff0ee48bd3","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:02.741409Z","modified":"2026-09-24T19:51:02.741409Z","name":"CVE-2026-86060","description":"RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)","external_references":[{"source_name":"cve","external_id":"CVE-2026-86060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86060"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:02.741409Z","modified":"2026-09-24T19:51:02.741409Z","name":"Exploit Public-Facing Application","external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190/"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--46be1fd2-269c-5421-a6dc-19643bf255cd","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:02.741409Z","modified":"2026-09-24T19:51:02.741409Z","relationship_type":"targets","source_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","target_ref":"vulnerability--ebacf3f2-8731-5dd9-bb73-c9ff0ee48bd3"},{"type":"report","spec_version":"2.1","id":"report--917d883f-5b1b-5703-bc42-cdd79bf3f9cf","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:02.741409Z","modified":"2026-10-30T14:11:53.155562Z","name":"MikroTik RouterOS CVE-2026-86060 exploited in the wild","description":"CISA lists CVE-2026-86060, a vulnerability in MikroTik RouterOS, in the Known Exploited Vulnerabilities catalog (added 2026-09-10, due 2026-09-13), and NVD records a CVSS of 9.2. This report summarizes public CTI only.","published":"2026-09-24T19:51:02.741409Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","vulnerability--ebacf3f2-8731-5dd9-bb73-c9ff0ee48bd3","attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","relationship--46be1fd2-269c-5421-a6dc-19643bf255cd"],"confidence":90}]}