MikroTik RouterOS SSH flaws let attackers seize admin control without passwords

September 23, 2026 at 09:06 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. CERT Polska calls the chain MikroTrick and says attack logs date to at least September 2, one day before MikroTik shipped patches in RouterOS 6.49.21, 7.23.4, and 7.24.2.

Key Facts

CERT Polska calls the exploit chain MikroTrick and says attack logs date to at least September 2, one day before MikroTik shipped patches.
The chain combines CVE-2026-67279, an SSH state-machine flaw, with CVE-2026-86060, an argument-injection bug in the RouterOS login process.
MikroTik released fixes in RouterOS 6.49.21, 7.23.4, and 7.24.2.
A diagnostic report on the MikroTik forum shows the attack sequence on one device: rejected authentication for -2, a forced renegotiation, a jump to the channel phase, and an exec request attempting to create a user called ops with full privileges.

The MikroTrick Chain

CVE-2026-67279 breaks the SSH authentication sequence by allowing a client to start an SSH key renegotiation during the authentication step, after which vulnerable RouterOS moves straight to the command phase without confirming the user's identity. CVE-2026-86060 turns that access into full administrative control because RouterOS launches a login program that receives the username and privilege level as command-line arguments without checking the username first. The attacker sends -2 as the username, which the login program treats as an instruction to read its identity and privilege level from file descriptor 2, pointing to the terminal the SSH session created. Through the SSH channel, the attacker has already written a chosen username and the privilege value for full administrative access to that terminal, and the login program accepts both and opens a fully privileged console.

Pre-Patch Exploitation Evidence

The chain leaves a distinctive trace in device logs: a failed login attempt for user -2. CERT Polska says logs matching this pattern appeared on the MikroTik forum as early as September 2, one day before the patches became available, and the team believes the chain was exploited before MikroTik released the fixes. A diagnostic report on the MikroTik forum shows the attack sequence on one device: rejected authentication for -2, a forced renegotiation, a jump to the channel phase, and an exec request attempting to create a user called ops with full privileges.