MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key
A chain of MikroTik RouterOS vulnerabilities, dubbed ‘MikroTrick’, allows attackers to gain full administrative control of internet-exposed routers without a password or SSH key. The vulnerabilities – CVE-2026-67279 and CVE-2026-86060 – exploit a sequence of authentication and login processes, enabling attackers to create a privileged account and potentially exfiltrate data. CERT Polska identified active exploitation of the argument-injection flaw as early as September 2nd, and CISA added the vulnerability to its catalog on September 10th. Patching is critical, and administrators should check for specific indicators of compromise, including a failed login for user -2 and the creation of an ‘ops’ account.
Two MikroTik RouterOS vulnerabilities, combined as ‘MikroTrick’, are enabling attackers to take full administrative control of internet-exposed routers without requiring a password or SSH key. The chain exploits a sequence of authentication and login processes. The vulnerabilities are CVE-2026-67279 (SSH state-machine flaw) and CVE-2026-86060 (argument-injection bug in the RouterOS login process). CERT Polska first identified the exploitation on September 5th, noting that logs matching a failed login attempt for user -2 appeared on the MikroTik forum as early as September 2nd, one day before the patches were released.
CVE-2026-67279 breaks the standard SSH sequence. If a client initiates an SSH key renegotiation during authentication, vulnerable RouterOS moves directly to the command phase without confirming the user's identity. This bypasses normal authentication. CVE-2026-86060 then leverages this access to create a fully privileged console. RouterOS launches a login program (/nova/bin/login) that receives the username and privilege level from the SSH daemon as command-line arguments, treating a hyphenated value as a program option rather than a name. The attacker sends -2 as the username, and the login program accepts this and creates a user called ‘ops’ with full privileges.
Evidence shows that the ‘ops’ account was successfully created on affected devices, with some reports indicating diagnostic-file creation followed by data transfers to an attacker IP address, suggesting configuration data was copied. CERT Polska has identified two IP addresses used in exploitation attempts: 82.192.72.4 and 103.102.31.18. The MikroTrick chain is a combination of these two vulnerabilities. CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10th, independently confirming active exploitation of the argument-injection flaw.
MikroTik states that its default home configuration does not expose SSH to the Internet, but administrators who have changed their firewall rules or manage devices over SSH from untrusted networks are at higher risk. No authoritative count of compromised devices has been published. Administrators should check for indicators of compromise, including a failed login for user -2, the creation of an ‘ops’ account, unknown users, scripts, scheduler entries, tunnels, proxies, unexpected .rif diagnostic files, or unexplained fetch activity. If any of these indicators are present, CERT Polska recommends isolating the device, preserving its logs and configuration, factory resetting it, and rebuilding it from a trusted configuration. All passwords, keys, and other credentials should be changed, and a backup from a compromised device should not be restored. CERT Polska utilized AI models, including GPT-5.5-cyber and GPT-5.6-sol through the OpenAI GTAC program, alongside locally hosted open-weight models to automate laboratory testing and protocol analysis.