MikroTik SSH auth-bypass chain exploited pre-patch
An unauthenticated SSH auth-bypass and argument-injection chain (MikroTrick) in RouterOS was exploited in the wild before MikroTik's 3 September patches, granting full admin access.
Sourcecert.pl — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-67277, CVE-2026-67279, and CVE-2026-86060 as exploited in the wild.
CERT Polska disclosed technical details of MikroTrick, a two-vulnerability chain in MikroTik RouterOS that grants an unauthenticated attacker full administrative console access. CVE-2026-67279 is a flaw in RouterOS's SSH server handling of mid-authentication rekeys: when a rekey completes during user authentication, the server incorrectly transitions to channel handling without ever sending SSH_MSG_USERAUTH_SUCCESS, letting an unauthenticated client open a session channel. CVE-2026-86060 is an argument-injection issue in /nova/bin/login: the unvalidated, attacker-supplied SSH username is passed as a positional argv element, and a username of "-2" is interpreted as a special flag causing login to read a username and effective policy mask from file descriptor 2 (the pseudoterminal itself), which the attacker fully controls. Chained together, these allow full unauthenticated administrative access without a password, SSH key, or completed authentication. Exploitation leaves a distinctive log signature: a failed login attempt for user "-2" followed by creation of a privileged "ops" account.
Public forum logs and CERT Polska's own reports show exploitation from IP 82.192.72.4 as early as 2 September, before patches for RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21 were released on 3 September, indicating attackers had the exploit chain before public disclosure. Observed post-exploitation activity included creation of the "ops" full-privilege account and exfiltration of RouterOS diagnostic (RIF) files back to the attacker IP via the fetch command. A separate, unrelated vulnerability (CVE-2026-67276) allows RSA-key impersonation but requires prior knowledge of account/key details and is unsuitable for mass exploitation; it was incorrectly conflated with MikroTrick in some reporting. CVE-2026-86060 and CVE-2026-67277 (also fixed by MikroTik) were added to CISA's KEV catalog on 10 September with a three-day remediation deadline. The article also details CERT Polska's use of LLM agents (GPT-5.5/5.6-derived models plus locally hosted open-weight models) to perform automated patch diffing, protocol state-machine fuzzing, and binary analysis, which compressed vulnerability rediscovery to within an hour of patch release and underscores that public/independent reconstruction of vendor patches now happens within days.
Defenders running RouterOS should patch immediately to 7.25beta3, 7.24.2, 7.23.4, or 6.49.21 or later, audit for unexpected "ops" accounts in the full privilege group, review SSH/system logs for failed login attempts with username "-2" from unfamiliar sources (especially 82.192.72.4), check for unexpected RIF diagnostic file creation and fetch-command transfers, and treat any device showing these indicators as potentially compromised prior to patching — RouterOS's own updated Flagged mechanism will disable and flag such accounts on newer versions.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs