MikroTrick Exploit Lets Attackers Hijack MikroTik Routers With No Password or Credentials

A two-vulnerability chain called MikroTrick is giving attackers full administrative control of internet-exposed MikroTik routers without requiring a password, SSH key, or completed authentication — and evidence shows it was used before patches were available.

CERT Polska identified the exploit chain, which combines two RouterOS SSH flaws to bypass login entirely. Attack logs trace active exploitation to at least September 2, 2026 — one day before MikroTik released patches in RouterOS versions 6.49.21, 7.23.4, and 7.24.2.

MikroTik routers are widely deployed across enterprise and service-provider networks globally. A successful takeover gives attackers complete control of network traffic routing and connected infrastructure. CISA added one of the two flaws to its Known Exploited Vulnerabilities catalog on September 10, independently confirming active in-the-wild exploitation and signaling that this threat is serious enough to demand immediate action from network administrators.

---

How the MikroTrick Chain Works

SSH authentication follows a strict three-step sequence: the connection is encrypted, the user is authenticated, and only then is a session opened for commands. The MikroTrick chain dismantles that sequence entirely using two chained vulnerabilities — and understanding how each piece fits together is critical to appreciating why this is so difficult to detect and stop mid-attack.

CVE-2026-67279: Breaking the SSH State Machine

The first flaw, CVE-2026-67279, breaks the SSH state machine. If an attacker initiates an SSH key renegotiation during the authentication phase, vulnerable RouterOS skips identity verification entirely and jumps directly to the command phase when renegotiation completes. No authentication success message is ever sent. The attacker has not been granted privileges yet — but they have bypassed the gate that was supposed to stop them.

This kind of state-machine confusion vulnerability is particularly dangerous because it exploits expected protocol behavior rather than a simple memory error or misconfiguration. The router is not malfunctioning — it is following its own flawed logic.

CVE-2026-86060: Converting Unauthorized Access Into Full Control

The second flaw, CVE-2026-86060, converts that unauthorized foothold into full administrative control. RouterOS launches a login binary at /nova/bin/login that accepts a username and privilege level as command-line arguments without first validating the username. When an attacker sends -2 as the username value, the login program interprets the hyphen as a program option rather than a name and reads its identity and privilege level from file descriptor 2 — the terminal created by the SSH session.

Because the attacker already controls that terminal through the SSH channel, they write a chosen username and the value for full administrative access before the login program reads it. The login program accepts both values and opens a fully privileged console. The attacker is now in complete control.

Why Chaining These Two Flaws Is So Consequential

Neither vulnerability alone achieves the same result. CVE-2026-67279 creates an unauthenticated channel with no privilege; CVE-2026-86060 requires an existing channel to exploit. Together, they form a seamless path from an unauthenticated TCP connection to root-level administrative access — with no credentials, no brute force, and no user interaction required. Conducting a thorough vulnerability assessment of your network infrastructure is one of the most effective ways to identify exposure to chained exploits like this before attackers find the path first.

---

Evidence of Pre-Patch Exploitation

Attack logs matching the MikroTrick pattern appeared on the MikroTik community forum as early as September 2, 2026. CERT Polska says this timing indicates the chain was actively exploited before MikroTik shipped fixes — a detail that matters enormously for administrators trying to determine their risk window.

One diagnostic report from the forum documents the attack sequence on a real device: a rejected authentication attempt for the username -2, a forced renegotiation, a jump to the channel phase, and an exec request attempting to create a user named ops with full administrative privileges. The SSH process crashed before the command completed on that particular device. On other affected devices, the ops account was successfully created.

In several incidents, CERT Polska found diagnostic-file creation followed by data transfers to an attacker-controlled IP address. This strongly suggests that device configuration data was exfiltrated to the attacker's infrastructure — a significant secondary consequence beyond simple access. Once configuration data leaves a network device, the blast radius of a compromise extends well beyond the router itself, potentially exposing VPN credentials, routing policies, firewall rules, and internal network topology.

CISA's September 10 addition of CVE-2026-86060 to its Known Exploited Vulnerabilities catalog independently confirmed that the argument-injection flaw was being used in active attacks. No authoritative count of compromised devices has been published.

Some reporting has incorrectly described MikroTrick as a three-vulnerability chain. CERT Polska clarifies that CVE-2026-67276 — a separate flaw allowing RSA key forgery — is not part of MikroTrick. That vulnerability requires knowing a valid account name and its public key and grants access only to that specific account.

---

What Administrators Should Do Right Now

Patch Immediately — Then Audit

Patching to RouterOS 6.49.21, 7.23.4, or 7.24.2 stops the attack chain from working. However, patching does not undo changes an attacker may have made before the update was applied. Updating the firmware closes the door; it does not evict anyone already inside.

After updating, administrators should run /system/device-mode/print and check the Flagged status. CERT Polska and MikroTik both caution that a clean result does not guarantee the device is uncompromised — the mechanism detects only selected indicators of tampering.

Indicators of Compromise to Check Immediately

CERT Polska published the following indicators of compromise observed in real attacks:

• Username: -2 appearing in SSH login logs
• Account: ops in the full-privilege group
• IP address: 82.192.72.4 (observed in successful attacks)
• IP address: 103.102.31.18 (used in exploitation attempts)

Administrators should also look for unknown user accounts, unauthorized scripts, new scheduler entries, unrecognized tunnels or proxies, unexpected .rif diagnostic files, and unexplained fetch activity.

MikroTik notes that its default home configuration does not expose SSH to the internet, but devices managed over SSH from untrusted networks or with modified firewall rules carry significantly higher risk. Reviewing network hardening strategies and best practices can help administrators reduce attack surface on exposed devices and limit the conditions that make exploit chains like MikroTrick possible.

If You Find Indicators of Compromise

Do not attempt to clean a compromised router in place. CERT Polska recommends:

1. Isolate the device immediately from the network
2. Preserve logs and configuration data for forensic review before making any changes
3. Perform a factory reset
4. Rebuild from a trusted, pre-compromise configuration

All passwords, SSH keys, and credentials associated with the device must be rotated. A backup taken from a compromised device should not be restored — doing so reintroduces attacker-placed changes, potentially including backdoor accounts or malicious scheduler tasks. For a broader review of credential hygiene across your organization following an incident like this, applying strong password security practices across all network-facing systems is an important step in limiting lateral movement if one device is ever used as a foothold.

How CERT Polska Conducted the Research

CERT Polska used AI models including GPT-5.5-cyber and GPT-5.6-sol through the OpenAI GTAC program alongside locally hosted open-weight models to automate laboratory testing and protocol analysis during the research. Every finding was verified against real RouterOS systems — a methodological detail worth noting, as AI-assisted vulnerability research is becoming an increasingly standard part of serious security disclosure work.

For further reading on MikroTik's own security advisories and RouterOS release notes, the MikroTik official security announcements page is the authoritative source for confirmed patch versions and disclosure details.

---

The MikroTrick disclosure is a reminder that chained vulnerabilities can be more dangerous than the sum of their parts — and that exploitation windows before patch release remain one of the most consequential risks in network security. Administrators can use the published indicators of compromise to audit exposed devices immediately, prioritize patch deployment for any RouterOS version below the fixed releases, and review firewall rules to ensure SSH is not unnecessarily reachable from public networks.