MikroTik RouterOS Vulnerability Chain Allows Unauthenticated Admin Access

Attackers are using a chain of two vulnerabilities in MikroTik RouterOS to bypass authentication and gain full administrative control over Internet-exposed routers.

The vulnerability chain, identified by CERT Polska as “MikroTrick”, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). This combination allows an unauthenticated attacker to reach the command phase of an SSH session and escalate privileges without a password or SSH key.

Technical Analysis of the MikroTrick Chain

The exploit begins with CVE-2026-67279, which targets the SSH protocol’s operational sequence. Under normal conditions, SSH requires a strict order of establishing a connection, authenticating the user, and then opening a session. This vulnerability breaks that sequence. If a client initiates an SSH key renegotiation during the authentication step, vulnerable RouterOS versions move directly to the command phase once the renegotiation finishes, without ever confirming the user’s identity.

The second flaw, CVE-2026-86060, transforms this unauthenticated access into full administrative control. The RouterOS login program, located at /nova/bin/login, receives the username and privilege level as command-line arguments but fails to validate the username first. By sending -2 as the username, an attacker can trick the program into reading its identity and privilege level from file descriptor 2. Because the attacker controls the terminal session created by the SSH channel, they can write a chosen username and full administrative privileges directly to that descriptor.

Active Exploitation and Detection

Evidence suggests the MikroTrick chain has been actively exploited in the wild. CERT Polska observed attack logs as early as 2 September, one day before MikroTik released security patches. Additionally, CISA has added the argument-injection flaw, CVE-2026-86060, to its Known Exploited Vulnerabilities catalogue, confirming its use by threat actors.

While MikroTik notes that default home configurations typically do not expose SSH to the Internet, administrators who have modified firewall rules or manage devices over untrusted networks face a high level of risk. Security researchers have identified several indicators of compromise (IoCs) in device logs, including:

• Failed login attempts for the username -2
• The creation of a new account named ops with full privileges
• Unexplained diagnostic files (.rif) or unexpected fetch activity
• Traffic to known attacker IP addresses, such as 82.192.72.4 or 103.102.31.18

Mitigation and Remediation

MikroTik has released patches to address these vulnerabilities in RouterOS versions 6.49.21, 7.23.4, and 7.24.2. Administrators are urged to update their firmware immediately.

However, because exploitation has been confirmed, patching alone does not guarantee security if an attacker has already established persistence. CERT Polska advises that after updating, administrators should check for unknown users, new scripts, scheduler entries, or unauthorised tunnels and proxies. If a compromise is suspected, the recommended response is to isolate the device, preserve logs and configuration, perform a factory reset, and rebuild the system from a trusted configuration. All passwords, keys, and credentials should be changed following the reset, and backups from potentially compromised devices should not be restored.