MikroTik SSH auth-bypass chain exploited pre-patch

An unauthenticated SSH auth-bypass and argument-injection chain (MikroTrick) in RouterOS was exploited in the wild before MikroTik's 3 September patches, granting full admin access.

CERT Polska disclosed technical details of MikroTrick, a two-vulnerability chain in MikroTik RouterOS that grants an unauthenticated attacker full administrative console access. CVE-2026-67279 is a flaw in RouterOS's SSH server handling of mid-authentication rekeys: when a rekey completes during user authentication, the server incorrectly transitions to channel handling without ever sending SSH_MSG_USERAUTH_SUCCESS, letting an unauthenticated client open a session channel. CVE-2026-86060 is an argument-injection issue in /nova/bin/login: the unvalidated, attacker-supplied SSH username is passed as a positional argv element, and a username of "-2" is interpreted as a special flag causing login to read a username and effective policy mask from file descriptor 2 (the pseudoterminal itself), which the attacker fully controls. Chained together, these allow full unauthenticated administrative access without a password, SSH key, or completed authentication. Exploitation leaves a distinctive log signature: a failed login attempt for user "-2" followed by creation of a privileged "ops" account.

Public forum logs and CERT Polska's own reports show exploitation from IP 82.192.72.4 as early as 2 September, before patches for RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21 were released on 3 September, indicating attackers had the exploit chain before public disclosure. Observed post-exploitation activity included creation of the "ops" full-privilege account and exfiltration of RouterOS diagnostic (RIF) files back to the attacker IP via the fetch command. A separate, unrelated vulnerability (CVE-2026-67276) allows RSA-key impersonation but requires prior knowledge of account/key details and is unsuitable for mass exploitation; it was incorrectly conflated with MikroTrick in some reporting. CVE-2026-86060 and CVE-2026-67277 (also fixed by MikroTik) were added to CISA's KEV catalog on 10 September with a three-day remediation deadline. The article also details CERT Polska's use of LLM agents (GPT-5.5/5.6-derived models plus locally hosted open-weight models) to perform automated patch diffing, protocol state-machine fuzzing, and binary analysis, which compressed vulnerability rediscovery to within an hour of patch release and underscores that public/independent reconstruction of vendor patches now happens within days.

Defenders running RouterOS should patch immediately to 7.25beta3, 7.24.2, 7.23.4, or 6.49.21 or later, audit for unexpected "ops" accounts in the full privilege group, review SSH/system logs for failed login attempts with username "-2" from unfamiliar sources (especially 82.192.72.4), check for unexpected RIF diagnostic file creation and fetch-command transfers, and treat any device showing these indicators as potentially compromised prior to patching — RouterOS's own updated Flagged mechanism will disable and flag such accounts on newer versions.

Source reporting: https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis