- A chain of two SSH vulnerabilities—CVE-2026-67279 and CVE-2026-86060—allows unauthenticated attackers to gain full administrative control over exposed MikroTik RouterOS devices.
- Active exploitation began before patches were released; fixes are available in RouterOS 6.49.21, 7.23.4, and 7.24.2.
- Attackers create a privileged ‘ops’ account and exfiltrate configuration data; indicators include username ‘-2’ in logs and IPs 82.192.72.4 and 103.102.31.18.
- Administrators should patch immediately and check for signs of compromise, including flagged device status and unknown files or users.
Security researchers have uncovered a critical vulnerability chain in MikroTik RouterOS that lets unauthenticated attackers take full administrative control of internet-exposed routers without any password or SSH key. The chain, dubbed “MikroTrick” by CERT Polska, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug (CVE-2026-86060) in the login process.
According to the technical analysis published by CERT Polska, the first vulnerability forces the SSH server to skip authentication during a key renegotiation, while the second abuses a login program to accept a crafted username “-2” that grants full administrative privileges. The attack sequence has been observed since at least September 2, one day before MikroTik shipped patches in RouterOS versions 6.49.21, 7.23.4, and 7.24.2.
Indicators of compromise include failed login logs for user “-2”, creation of a privileged account named “ops”, and connections to attacker-controlled IPs such as 82.192.72.4 and 103.102.31.18. CerT Polska found evidence of configuration data being transferred to attacker infrastructure after exploitation, and a diagnostic report on the MikroTik forum confirms the attack sequence on a device.
MikroTik states that its default home configuration does not expose SSH to the internet, but administrators who have modified firewall rules face higher risk. After patching, administrators should check the Flagged status by running /system/device-mode/print (see the device-mode documentation) and search for unknown scripts, scheduler entries, or unexpected .rif files.
If compromise is suspected, CERT Polska recommends isolating the device, preserving logs, factory resetting it, and rebuilding from a trusted configuration—do not restore backups from an infected system. All passwords and keys should be changed. CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10, independently confirming active exploitation. Note that a separate SSH flaw, CVE-2026-67276, is not part of this chain and requires prior knowledge of a user’s public key to exploit.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
