{"id":1960,"date":"2026-09-24T14:26:26","date_gmt":"2026-09-24T08:56:26","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1960"},"modified":"2026-09-28T09:12:46","modified_gmt":"2026-09-28T03:42:46","slug":"mikrotrick-mikrotik-routeros-ssh-exploit-chain","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/mikrotrick-mikrotik-routeros-ssh-exploit-chain\/","title":{"rendered":"MikroTrick RouterOS Exploit Chain Enables Passwordless MikroTik Takeover"},"content":{"rendered":"

MikroTrick is a two-vulnerability exploit chain that can give attackers full administrative access to vulnerable MikroTik RouterOS devices without a password or SSH key.<\/p>\n

CERT Polska found that CVE-2026-67279 can move an unauthenticated SSH connection into channel handling after a client-triggered rekey. CVE-2026-86060 then lets an attacker manipulate the policy mask passed to the RouterOS login process. Combined, the flaws open a fully privileged administrative console without completing user authentication.<\/p>\n

MikroTik released fixes on September 3, 2026, in RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable). The fix was also included in 7.25beta3. MikroTik advised administrators not to expose SSH or other management services to untrusted networks.<\/p>\n

MikroTrick at a Glance<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n
Detail<\/span><\/b>\u00a0<\/span><\/td>\nInformation<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
Product<\/span>\u00a0<\/span><\/td>\nMikroTik RouterOS<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Exploit chain<\/span>\u00a0<\/span><\/td>\nCVE-2026-67279 + CVE-2026-86060<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVE-2026-67279<\/span>\u00a0<\/span><\/td>\nImproper enforcement of behavioral workflow (CWE-841) affecting the SSH authentication state machine<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVE-2026-86060<\/span>\u00a0<\/span><\/td>\nArgument injection (CWE-88) in the RouterOS SSH login path<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Prerequisite<\/span>\u00a0<\/span><\/td>\nAttacker can reach the RouterOS SSH service; confirmed in-the-wild attacks targeted devices with SSH accessible from public networks.<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Potential impact<\/span>\u00a0<\/span><\/td>\nFull unauthenticated administrative console access<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Fixed releases<\/span>\u00a0<\/span><\/td>\n6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable); fix also included in 7.25beta3<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Exploitation evidence<\/span>\u00a0<\/span><\/td>\nPublic attack logs date to September 2, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CISA KEV<\/span>\u00a0<\/span><\/td>\nCVE-2026-86060 added September 10, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

CERT Polska’s technical analysis<\/a> identifies CVE-2026-67279 and CVE-2026-86060 as the two vulnerabilities that form the MikroTrick exploit chain.<\/p>\n

CVE-2026-86060 carries a CVSS v4.0 score of 9.2. CERT Polska classifies CVE-2026-67279 as an improper enforcement of behavioral workflow vulnerability (CWE-841).<\/p>\n

How an SSH Rekey Lets MikroTrick Skip Authentication<\/h2>\n

The first part of MikroTrick breaks the expected order of SSH operations.<\/p>\n

SSH first establishes the protected transport and then authenticates the user. After successful authentication, the SSH connection protocol can open channels for functions such as shells and command execution.<\/p>\n

RouterOS versions affected by CVE-2026-67279 mishandled a client-initiated SSH rekey during user authentication. When that rekey finished, the SSH server moved into channel handling instead of returning to the interrupted authentication stage.<\/p>\n

Consequently, RouterOS could accept a session channel even though it had never sent the normal SSH_MSG_USERAUTH_SUCCESS<\/code> message.<\/p>\n

However, this flaw alone does not create an authenticated identity or assign administrative privileges. Instead, it provides the unauthenticated session channel required for the second vulnerability.<\/p>\n

How the -2 Username Turns the Bypass Into Full Admin Access<\/h2>\n

CVE-2026-86060 provides the second stage of MikroTrick. It allows an attacker who reaches the RouterOS login helper to supply an attacker-controlled policy mask.<\/p>\n

RouterOS uses \/nova\/bin\/login<\/code> to create the console. The SSH daemon passes the username and effective policy mask to this program as command-line arguments.<\/p>\n

Before the patch, RouterOS did not adequately validate the username before passing it to login<\/code>. Therefore, a username beginning with a hyphen could be interpreted as an option rather than an ordinary username.<\/p>\n

The attacker uses -2<\/code> as the username.<\/p>\n

The login<\/code> program interprets -2<\/code> as an instruction to read identity and policy information from file descriptor 2. That descriptor points to the pseudoterminal established for the SSH session.<\/p>\n

File descriptors 0, 1, and 2 used by the login<\/code> process share the pseudoterminal’s input queue. Therefore, an attacker can send data through the SSH channel that login then uses as the effective policy mask.<\/p>\n

Combined with CVE-2026-67279, this produces full unauthenticated access to the RouterOS administrative console.<\/p>\n

The two-stage dependency is what makes the attack distinctive:<\/p>\n

SSH rekey state error \u2192 unauthenticated session channel \u2192 -2<\/code> argument injection \u2192 attacker-controlled policy mask \u2192 administrative console<\/strong><\/p>\n

What the Pre-Patch MikroTrick Activity Revealed<\/h2>\n

CERT Polska found the earliest publicly available attack logs dated September 2, 2026. This was one day before MikroTik published the patched RouterOS releases.<\/p>\n

Public reports repeatedly contained three indicators: connections from 82.192.72.4<\/code>, an authentication attempt using -2<\/code>, and creation of an ops<\/code> account with full privileges.<\/p>\n

One published diagnostic report showed rejected authentication, rekeying, channel creation, and command delivery. On that particular router, however, the SSH process crashed before the attack completed.<\/p>\n

Other reports documented successful creation of the privileged account. CERT Polska also identified cases where a RIF diagnostic file was created and data was then transferred to 82.192.72.4<\/code> using RouterOS fetch<\/code>.<\/p>\n

The researchers described the sequence as strongly suggesting diagnostic-file exfiltration.<\/p>\n

CERT Polska subsequently confirmed that attackers were exploiting MikroTrick in the wild to take full control of RouterOS devices with SSH accessible from public networks.<\/p>\n

CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10.<\/p>\n

How Enterprises Should Check MikroTik Routers for MikroTrick<\/h2>\n

Updating RouterOS to a release containing the MikroTrick fixes prevents the observed attacks, but administrators should still inspect the device for unauthorized configuration changes and other signs of prior compromise.<\/p>\n

After updating, administrators should check the RouterOS logs for a critical entry showing that RouterOS marked the device as Flagged. They should also review the configuration for unknown users, scripts, or other unrecognized changes. The Flagged mechanism detects only selected compromise artifacts, so a router without a Flagged state may still be compromised.<\/p>\n

Look specifically for:<\/p>\n