MikroTrick Attack Chains Two MikroTik RouterOS Vulnerabilities for Full Administrative Access

Two MikroTik RouterOS vulnerabilities can be chained to gain full administrative control of Internet-exposed routers without requiring a password, SSH key, or completed authentication.

CERT Polska has named the attack chain MikroTrick. It combines an SSH state-machine vulnerability, CVE-2026-67279, with an argument-injection vulnerability in the RouterOS login process, CVE-2026-86060.

Attack logs indicate that the chain was being used as early as September 2, 2026, one day before MikroTik released patches in RouterOS 6.49.21, 7.23.4, and 7.24.2.

How the MikroTrick Attack Chain Works

SSH normally follows three stages:

  1. Establish an encrypted connection
  2. Authenticate the user
  3. Allow the authenticated client to open a session and execute commands

The server confirms successful authentication using the SSH_MSG_USERAUTH_SUCCESS message.

CVE-2026-67279 Bypasses the SSH Authentication Sequence

CVE-2026-67279 is an SSH state-machine vulnerability that allows an unauthenticated client to reach a stage of the SSH connection that should only be accessible after successful authentication.

If an attacker initiates an SSH key renegotiation during the authentication process, vulnerable RouterOS can move directly into the command phase after the renegotiation finishes without confirming the user's identity.

The vulnerability does not independently provide administrative privileges. Instead, it allows an unauthenticated attacker to reach a privileged stage of the SSH protocol.

CVE-2026-86060 Enables Administrative Control

CVE-2026-86060 affects the RouterOS login process.

RouterOS launches /nova/bin/login and passes the username and privilege level received from the SSH daemon as command-line arguments. The username is not properly validated before being processed.

The attacker provides the following username:

-2

Because the value begins with a hyphen, the login program interprets it as an option rather than a normal username.

The option causes the login program to read identity and privilege information from file descriptor 2, which points to the terminal created for the SSH session.

The attacker can then send a selected username and privilege value through the SSH channel. The login process accepts these values and opens a console with full administrative privileges.

Together, the two vulnerabilities allow an attacker to move from an unauthenticated SSH connection to complete administrative control of the RouterOS device.

Evidence of Pre-Patch Exploitation

The attack leaves a distinctive trace in RouterOS logs: a failed SSH login attempt involving the username -2.

CERT Polska reported that logs showing this pattern appeared on the MikroTik forum as early as September 2, 2026, before the security patches were released.

One diagnostic report documented the following sequence:

  • Authentication attempt using -2
  • Forced SSH renegotiation
  • Transition to the SSH channel phase
  • An exec request
  • An attempt to create an account named ops with full privileges

The SSH process crashed before the command completed on that particular device.

Other reports showed that attackers successfully created the ops account with full administrative privileges.

CERT Polska also observed incidents where diagnostic files were created and data was subsequently transferred to attacker-controlled IP addresses, suggesting that configuration information may have been copied from compromised devices.

CVE-2026-67276 Is a Separate Vulnerability

CERT Polska clarified that CVE-2026-67276 is not part of the MikroTrick attack chain.

The vulnerability is a separate RouterOS SSH issue that can allow an attacker to forge an RSA key and authenticate as an existing user.

However, exploitation requires knowledge of the account name and its public key, and the resulting access is limited to that account.

The MikroTrick chain specifically combines:

  • CVE-2026-67279
  • CVE-2026-86060

CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10, 2026, confirming active exploitation of the argument-injection vulnerability.

Internet-Exposed SSH Increases Risk

The attack requires the RouterOS SSH service to be reachable by the attacker.

MikroTik states that its default home configuration does not expose SSH directly to the Internet. However, devices can become exposed when administrators modify firewall rules or allow SSH management from untrusted networks.

No authoritative count of compromised devices has been published.

Indicators of Compromise

Patching prevents further exploitation, but updating RouterOS does not automatically remove changes made by an attacker before the device was patched.

After updating, administrators should check the device's Flagged status using:

/system/device-mode/print

The Flagged mechanism detects selected traces of compromise, but an unflagged device should not automatically be considered clean.

CERT Polska identified the following indicators from observed attacks:

IndicatorValueSSH username-2Suspicious accountopsObserved attacker IP82.192.72.4Exploitation attempt IP103.102.31.18

Administrators should also look for:

  • Unknown user accounts
  • Unexpected scripts
  • Suspicious scheduler entries
  • Unrecognized tunnels
  • Unexpected proxies
  • .rif diagnostic files
  • Unexplained fetch activity
  • Other unexplained configuration changes

What to Do If a Router Is Compromised

If any indicators of compromise are found, CERT Polska recommends:

  1. Isolate the affected router.
  2. Preserve logs and configuration information.
  3. Factory reset the device.
  4. Rebuild the configuration from a trusted source.
  5. Change all passwords, SSH keys, and other credentials.
  6. Do not restore configuration backups from a potentially compromised device.

A security update alone may not remove persistence or unauthorized configuration changes that were introduced before patching.

AI-Assisted Research

CERT Polska said it used AI models, including GPT-5.5-cyber and GPT-5.6-sol through the OpenAI GTAC program, together with locally hosted open-weight models, to automate parts of its laboratory testing and protocol analysis.

The researchers said that every finding was verified against real RouterOS systems.

Key Takeaway

The MikroTrick attack demonstrates how two separate MikroTik RouterOS vulnerabilities can be combined to bypass SSH authentication and obtain full administrative access.

Administrators should update affected RouterOS installations, restrict SSH access to trusted management networks, and investigate existing devices for signs of compromise. Patching should be accompanied by credential rotation and a trusted rebuild when compromise is suspected.