The disclosure of the full technical details behind MikroTrick reveals a particularly dangerous attack chain affecting MikroTik RouterOS devices.

Researchers at CERT Polska found that two separate vulnerabilities could be chained to allow an attacker to gain full administrative control of a MikroTik router without knowing a password, possessing an SSH private key, or successfully completing user authentication.

The chain combines:

  • CVE-2026-67279, an SSH state-machine vulnerability; and
  • CVE-2026-86060, an argument-injection vulnerability in the RouterOS login process.

The attack requires the RouterOS SSH service to be reachable by the attacker.

That requirement limits the exposure compared with a vulnerability affecting every device regardless of configuration, but for organizations that expose SSH management to public or untrusted networks, the consequences can be severe.

The first vulnerability breaks the expected SSH authentication sequence

SSH normally follows a strict sequence:

transport negotiation → user authentication → session establishment → command execution

The server should not allow a user to open an administrative session until authentication has been completed successfully.

CVE-2026-67279 breaks this assumption.

CERT Polska discovered that if an SSH client requests a key renegotiation while the connection is still in the authentication phase, vulnerable RouterOS versions incorrectly transition into the SSH connection protocol once that renegotiation completes.

Crucially, this happens without the user having authenticated.

The attacker can therefore reach a stage where they can create a session channel and issue an exec request even though RouterOS has never confirmed the user's identity.

The vulnerability by itself does not automatically produce a fully privileged administrative session.

But it places the attacker somewhere they should never be before authentication has occurred:

inside the command-processing path.

The second vulnerability converts that access into full administrator privileges

This is where CVE-2026-86060 enters the chain.

RouterOS uses the internal program:

/nova/bin/login

to establish the user's session and apply the appropriate RouterOS privilege policy.

Information such as the username and privilege level is passed to this program as command-line arguments.

CERT Polska discovered that RouterOS failed to properly validate usernames beginning with special argument characters.

The attack uses the username:

-2

Rather than treating -2 purely as a username, the login program interprets it as an option.

This causes the program to read identity and policy information through file descriptor 2, which is associated with the terminal created for the SSH session.

Because the attacker already controls data sent through that SSH channel, they can supply their own username and a RouterOS privilege mask corresponding to full administrative access.

The result is remarkable:

an unauthenticated SSH connection becomes a fully privileged RouterOS console.

Why chaining matters

Neither vulnerability tells the whole story by itself.

CVE-2026-67279 breaks the SSH workflow and lets an unauthenticated client reach functionality that should require login.

CVE-2026-86060 manipulates how the login process interprets arguments and lets the attacker control the resulting privilege level.

Together:

SSH state-machine bypass → unauthenticated session channel → login argument manipulation → attacker-controlled privilege mask → full administrative access

This is an excellent example of why vulnerability assessment cannot always be performed one CVE at a time.

A bug with apparently constrained impact can become dramatically more dangerous when another flaw removes the restriction that normally limits it.

The attack appears to have been used before patches became available

MikroTik released patched RouterOS versions on September 3, 2026.

CERT Polska subsequently examined logs posted publicly by MikroTik administrators and identified activity dating to at least September 2.

One of the characteristic entries was:

login failure for user -2

followed by the creation of an account named:

ops

with full privileges.

This apparently contradictory sequence was one of the clues that allowed researchers to reconstruct what the attackers were doing.

A login had supposedly failed.

Yet the same SSH activity was followed by creation of a privileged account.

That indicated the authentication failure was not actually preventing the attacker from reaching privileged RouterOS functionality.

CERT Polska therefore believes the MikroTrick chain was exploited before the patches were released.

Attackers created a persistent full-privilege account

Observed attacks created an account named:

ops

and placed it in RouterOS's:

full

privilege group.

This provides persistence independent of repeatedly exploiting the vulnerability.

Once that administrative account exists, patching the original vulnerabilities does not automatically remove it.

That is why organizations cannot treat firmware installation alone as complete incident remediation.

If attackers exploited MikroTrick before the update, they may already have established legitimate-looking administrative access.

Configuration data may also have been stolen

CERT Polska observed incidents where attackers generated RouterOS diagnostic files and subsequently transferred data to external infrastructure.

This strongly suggests attackers may have copied configuration or diagnostic information from compromised routers.

Such information can be highly valuable.

Router configuration may reveal:

  • internal network topology;
  • IP addressing;
  • firewall policies;
  • VPN configuration;
  • routing information;
  • remote peers;
  • service exposure;
  • administrative configuration; and
  • potentially credentials or other secrets depending on the exported material.

A router therefore represents both an access point and an intelligence source.

Why router compromise is particularly serious

A compromised workstation affects one endpoint.

A compromised router can potentially affect the traffic and connectivity of many systems behind it.

With full administrative privileges, an attacker may potentially be able to:

  • create administrative accounts;
  • alter firewall rules;
  • change routing;
  • manipulate DNS settings;
  • establish tunnels;
  • enable additional management services;
  • configure proxies;
  • redirect network traffic;
  • inspect network configuration;
  • use the router as a foothold for internal attacks; or
  • use the device as infrastructure for attacks against third parties.

These are general consequences of administrator-level router compromise and should not be interpreted as confirmation that every capability was used in the observed MikroTrick attacks.

But they explain why a pre-authentication takeover of an Internet-facing router demands urgent attention.

Internet-exposed SSH is the key attack surface

The MikroTrick chain requires the attacker to reach the RouterOS SSH service.

MikroTik notes that its default home-router firewall configuration does not expose management services directly to the Internet.

However, organizations frequently modify defaults to support remote administration.

Routers used by:

  • ISPs;
  • enterprises;
  • branch offices;
  • managed service providers;
  • hosting environments; or
  • network administrators

may intentionally expose SSH or permit access from broad ranges.

Those configurations represent the highest-risk population.

This incident therefore reinforces a basic principle:

Management interfaces should not be unnecessarily exposed to untrusted networks.

Remote management should ideally be restricted through VPNs, dedicated management networks, jump hosts, or tightly controlled source-address rules.

MikroTik has released fixes

The primary MikroTrick vulnerabilities were fixed in:

  • RouterOS 6.49.21
  • RouterOS 7.23.4
  • RouterOS 7.24.2

Organizations running affected releases should update immediately.

Administrators should verify the actual installed RouterOS version rather than assuming automatic updates have occurred.

Large environments should also inventory RouterOS devices centrally, since forgotten branch routers and remotely deployed appliances frequently remain on older versions far longer than core infrastructure.

Updating is necessary, but it is not enough

If a router was exposed before patching, administrators need to investigate whether compromise already occurred.

CERT Polska recommends checking RouterOS logs for:

login failure for user -2

Administrators should also look for an unexpected account named:

ops

particularly if it belongs to the:

full

group.

Observed attacker infrastructure includes:

82.192.72[.]4

and:

103.102.31[.]18

The first was associated with successful attacks, while the second was observed in exploitation attempts.

These indicators provide useful starting points, but their absence does not prove a router is safe.

Attackers can change usernames and IP addresses immediately after public disclosure.

Check RouterOS Flagged status

Administrators should also run:

/system/device-mode/print

and inspect the:

flagged

status.

MikroTik's Flagged mechanism can identify certain suspicious configuration changes associated with compromise.

However, CERT Polska specifically warns that:

flagged: no does not prove that the router is clean.

The mechanism detects selected known indicators rather than every possible post-exploitation action.

This distinction is extremely important.

Security controls designed to detect known attacker behavior are useful evidence, not certificates of innocence.

Hunt for unexpected configuration changes

Administrators should examine the router for:

  • unknown user accounts;
  • unusual full-privilege accounts;
  • unexpected scripts;
  • scheduler entries;
  • new tunnels;
  • proxy configuration;
  • unexpected firewall changes;
  • unfamiliar SSH keys;
  • suspicious .rif diagnostic files;
  • unusual fetch commands;
  • unexpected configuration exports; and
  • unexplained outbound connections.

Comparing the current configuration against a known-good baseline can significantly accelerate this process.

This is another reason organizations should maintain version-controlled backups of network-device configuration.

Without a baseline, distinguishing compromise from years of legitimate configuration drift becomes considerably more entertaining than anyone wanted.

Compromised routers should be rebuilt, not simply cleaned manually

Where indicators of compromise are discovered, CERT Polska recommends isolating the device and preserving evidence before remediation.

The router should then be factory reset and rebuilt using a trusted configuration.

Importantly:

a complete backup taken from the compromised router should not simply be restored.

Doing so may reintroduce malicious accounts, scripts, scheduler entries, tunnels, or other persistence.

Administrators should instead reconstruct the configuration from a verified known-good source.

Passwords, SSH keys, VPN credentials, API secrets, and other credentials that may have been accessible from the device should also be rotated.

There is another MikroTik SSH flaw, but it is not part of MikroTrick

Some earlier reports incorrectly associated CVE-2026-67276 with the MikroTrick chain.

CERT Polska's later technical analysis clarifies that the actual chain is:

CVE-2026-67279 + CVE-2026-86060

CVE-2026-67276 is a separate SSH vulnerability involving incomplete verification of RSA public keys.

That issue can allow an attacker who knows an account name and the modulus of its authorized RSA public key to forge authentication and impersonate that user.

However, it provides access only with the privileges of that existing account and requires prior information about the account.

MikroTrick is considerably better suited to broad exploitation because it does not require knowledge of an existing account or authorized SSH key.

The broader RouterOS disclosure includes several other serious flaws

CERT Polska disclosed six RouterOS vulnerabilities during the same research effort.

In addition to the MikroTrick pair, researchers identified issues involving:

  • RSA signature verification;
  • the bandwidth-test service;
  • WebFig file access;
  • uninitialized kernel memory;
  • certificate validation; and
  • SSH authentication.

One WebFig vulnerability, CVE-2026-67281, could allow unauthenticated file access under vulnerable conditions, potentially exposing root-owned files and configuration stores containing credentials.

CVE-2026-67277 affects RouterOS's bandwidth-test service and could cause kernel-memory disclosure or remote denial of service.

This broader set of findings reinforces why administrators should apply the complete vendor update rather than attempting to mitigate only the two flaws used in MikroTrick.

CISA has recognized active exploitation

CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog after the reports of exploitation.

That independently elevates the flaw from a theoretical risk to one associated with confirmed real-world attacker activity.

For vulnerability-management teams, KEV status should substantially increase remediation priority.

The question is no longer:

“Could someone exploit this router?”

There is evidence that attackers already have.

Router security deserves endpoint-style monitoring

MikroTrick also demonstrates a recurring weakness in enterprise monitoring.

Organizations may deploy EDR agents to thousands of laptops and servers while routers, firewalls, switches, and VPN appliances receive comparatively little behavioral monitoring.

Network appliances frequently cannot run conventional endpoint agents.

That makes centralized collection of their available telemetry even more important.

Organizations should forward:

  • authentication events;
  • configuration changes;
  • administrative actions;
  • account creation;
  • service changes;
  • VPN events; and
  • relevant system logs

to a centralized monitoring platform.

Creating an administrator account on a router at 3 a.m. should not remain interesting only after someone happens to inspect the device two weeks later.

The incident also demonstrates why protocol state matters

From a software-security perspective, CVE-2026-67279 is particularly interesting because the problem is not a classic buffer overflow or memory corruption.

The vulnerability is a workflow failure.

SSH authentication consists of multiple protocol states, and the software incorrectly permitted a transition from one state to another.

The system effectively assumed:

“If we reached this stage, authentication must already have happened.”

The attacker found a path where that assumption was false.

This type of vulnerability can be difficult to identify with ordinary input-validation testing because every individual protocol message may be valid.

The vulnerability exists in the sequence in which those messages are processed.

For developers of security appliances, this is an important lesson:

state transitions themselves are part of the attack surface.

The research also highlights the emerging role of AI in vulnerability analysis

CERT Polska's technical report describes the use of LLM agents alongside conventional reverse engineering and laboratory verification during the RouterOS research.

The researchers used AI models to assist with protocol analysis, hypothesis testing, and automated experimentation, while every reported finding was verified against actual RouterOS systems.

That is an interesting parallel to the growing use of AI by attackers.

The same technologies that can accelerate offensive reconnaissance can also help defenders and researchers analyze complex binaries and protocol behavior more quickly.

The useful distinction remains verification.

AI can generate hypotheses quickly.

Security conclusions still require evidence.

The broader cybersecurity lesson

MikroTrick demonstrates how attackers can combine two individually distinct implementation mistakes to cross an entire security boundary:

unauthenticated Internet client → SSH connection → authentication bypass → session channel → login argument injection → full RouterOS administrator

No password is stolen.

No private SSH key is required.

No legitimate administrator needs to approve anything.

The attacker simply abuses assumptions inside the authentication and privilege-assignment mechanisms.

For organizations operating MikroTik devices, the lesson is therefore broader than patching these two CVEs.

Internet-facing management services should be minimized.

Network-device logs should be centralized.

Configuration integrity should be continuously monitored.

Administrative accounts should be regularly reviewed.

And when an actively exploited pre-authentication vulnerability affects a router, updating the firmware should be followed by compromise assessment rather than a relieved closing of the vulnerability ticket.

A router sits at one of the most trusted positions in the network. MikroTrick shows why attackers increasingly want to compromise that trust rather than fight through it.

Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at

Source: MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key via The Hacker News — published 23 Sep 2026.