MikroTrick chain exposes unpatched MikroTik RouterOS SSH services
CERT Polska has detailed a two-vulnerability chain, dubbed MikroTrick, that can give attackers full administrative control of Internet-exposed MikroTik RouterOS devices without a password, SSH key or completed authentication. The chain combines the SSH state-machine flaw CVE-2026-67279 with the RouterOS login argument-injection flaw CVE-2026-86060.
MikroTik released fixes in RouterOS 6.49.21, 7.23.4 and 7.24.2. CERT Polska said attack logs date to at least September 2, one day before the patches became available, indicating that the chain was exploited before the fixes were released.
How the two flaws produce an administrator session
Under the normal SSH sequence, a server establishes encryption, authenticates the user and then permits a session and commands. Authentication is completed only after the server sends an SSH_MSG_USERAUTH_SUCCESS message.
CVE-2026-67279 disrupts that order. When a client initiates SSH key renegotiation while authentication is under way, a vulnerable RouterOS system can enter the command phase once renegotiation ends without confirming the client identity. The flaw alone neither creates an authenticated session nor assigns privileges, but it reaches a stage that should be available only after login.
CVE-2026-86060 supplies the escalation step. RouterOS starts /nova/bin/login with a username and privilege level received from the SSH daemon as command-line arguments, without validating the username first. An attacker can submit -2 as the username; the login program interprets it as an option that reads identity and privilege data from file descriptor 2, the terminal created for the SSH session.
The attacker can write a chosen username and a full-administrator privilege value to that terminal through the SSH channel. The login program accepts those values and opens a privileged console.
Indicators and scope of observed activity
CERT Polska identified a failed SSH login for user -2 as a distinctive trace. A MikroTik forum diagnostic report recorded rejected authentication for that value, forced renegotiation, a move to the channel phase and an execution request intended to create a full-privilege user named ops. Although the SSH process crashed before completion on that device, other reports confirmed successful creation of the account.
In some incidents, CERT Polska observed diagnostic-file creation followed by transfers to an attacker IP address, which strongly suggests configuration data was copied to attacker infrastructure. The organization listed 82.192.72.4 in successful attacks and 103.102.31.18 in exploitation attempts.
CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10, independently confirming active exploitation of the argument-injection issue. CERT Polska stressed that CVE-2026-67276 is not part of MikroTrick: that separate SSH flaw can forge an RSA key for an existing account, but requires knowledge of both the account name and public key.
Actions after patching
The chain requires SSH to be reachable by an attacker. MikroTik says the default home configuration does not expose SSH to the Internet, but devices managed over SSH from untrusted networks or protected by modified firewall rules face higher exposure. No authoritative count of compromised devices has been published.
Administrators should update first, then run /system/device-mode/print to inspect the Flagged status. MikroTik and CERT Polska caution that this mechanism detects only selected compromise traces, so an unflagged system cannot be treated as proof of safety.
Teams should also review unknown users, scripts, scheduler entries, tunnels, proxies, unexpected .rif diagnostic files and unexplained fetch activity. If indicators appear, the practical response is to isolate the router, preserve logs and configuration, factory-reset it and rebuild from a trusted configuration; passwords, keys and other credentials should be changed, and backups from a compromised device should not be restored.