Attack logs date to at least September 2, 2026 — one day before MikroTik released fixes — after researchers found two RouterOS flaws that, chained together, let unauthenticated attackers open a fully privileged console on Internet‑exposed devices.
How the MikroTrick chain (CVE-2026-67279 + CVE-2026-86060) works
The exploitation is a two-step chain identified by CERT Polska as “MikroTrick.” It combines an SSH state‑machine flaw, CVE-2026-67279, with an argument‑injection bug in the RouterOS login process, CVE-2026-86060.
CVE-2026-67279 breaks SSH’s required order of operations. Normally SSH establishes an encrypted connection, authenticates the user, and then confirms success with an SSH_MSG_USERAUTH_SUCCESS message before allowing a client to open a session and run commands. On vulnerable RouterOS systems, if a client triggers an SSH key renegotiation during authentication, the server can move straight to the command phase when renegotiation completes — without confirming the user’s identity. That alone does not grant privileges, but it allows an unauthenticated client to reach a stage that should require a completed login.
CVE-2026-86060 turns the unauthenticated channel into administrative control. RouterOS launches a login program (/nova/bin/login) that receives the username and a privilege level from the SSH daemon as command‑line arguments without validating the username first. A username value beginning with a hyphen is treated as a program option. An attacker sends “-2” as the username; the login program interprets that as an instruction to read identity and privilege level from file descriptor 2 (the terminal the SSH session created). Through the SSH channel the attacker already controls that terminal and can supply a chosen username and the privilege value for full administrative access. The login program then accepts both and opens a fully privileged console.
Evidence of exploitation before MikroTik’s patches
CERT Polska reported logs matching this attack pattern on September 2, 2026, and the research team believes the chain was exploited before MikroTik published patches. MikroTik shipped updates in RouterOS versions 6.49.21, 7.23.4, and 7.24.2 the following day.
The attack leaves a distinctive trace in logs: a failed login attempt for user “-2.” A diagnostic report posted on the MikroTik forum shows a rejected authentication for -2, a forced renegotiation, a jump to the channel phase, and an exec request attempting to create a user named ops with full privileges. On that device the SSH process crashed before the command completed, but other reports confirmed ops was successfully created on affected systems.
CERT Polska also observed diagnostic‑file creation followed by data transfers to a remote IP address — behavior the team says strongly suggests configuration data was copied to attacker infrastructure. The advisory notes no authoritative count of compromised devices has been published.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleIndicators, checks, and immediate steps from CERT Polska and MikroTik
- Log indicator: username “-2” in SSH login logs.
- Compromised account: ops in the full‑privilege group.
- Observed IP addresses: 82.192.72.4 (seen in successful attacks) and 103.102.31.18 (used in exploitation attempts).
- Post‑patch check: run /system/device-mode/print to inspect the Flagged status. CERT Polska and MikroTik warn the Flagged mechanism detects only selected traces and its absence does not prove a device is safe.
- Other items to audit: unknown users, scripts, scheduler entries, tunnels, proxies, unexpected .rif diagnostic files, or unexplained fetch activity.
CERT Polska recommends isolating any device showing indicators, preserving logs and configuration, factory resetting the device, and rebuilding from a trusted configuration. All passwords, keys, and other credentials should be changed; backups from a compromised device should not be restored.
CISA action, patch availability, and mitigating exposure
CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10, confirming independent recognition of active exploitation of the argument‑injection flaw. MikroTik’s patches were released in RouterOS 6.49.21, 7.23.4, and 7.24.2; CERT Polska’s September 5 advisory had already warned that RouterOS SSH flaws were being used to take control of Internet‑reachable devices.
MikroTik notes that its default home configuration does not expose SSH to the Internet. Administrators who altered firewall rules or who manage devices over SSH from untrusted networks face higher risk because the chain requires SSH to be reachable from the attacker.
Some publications have conflated this chain with a separate SSH vulnerability, CVE-2026-67276. CERT Polska clarifies that CVE-2026-67276 is distinct: it allows forging an RSA key to log in as an existing user but requires knowing the account name and its public key and grants access only to that account.
What this means for administrators, policymakers, and enterprise buyers
- Administrators and network operators: prioritize patching to stop further exploitation, then perform the checks CERT Polska and MikroTik list. If indicators are present, isolate the device, preserve evidence, factory reset and rebuild from trusted configurations, and rotate all credentials — do not restore from backups taken after compromise.
- Policymakers and regulators: CISA’s KEV listing shows the argument‑injection flaw is treated as actively exploited; agencies tracking exploited vulnerabilities may use that designation to prioritize remediation directives or procurement guidance for affected equipment.
- Enterprise procurement and IT leaders: verify device configurations do not expose SSH to public networks and insist on robust patching processes and post‑incident rebuild procedures for endpoint network equipment; a compromised backup should not be reused.
CERT Polska used a mix of AI-assisted methods — including GPT-5.5-cyber and GPT-5.6-sol via the OpenAI GTAC program, plus local open‑weight models — to automate lab testing and protocol analysis, and verified each finding against real RouterOS systems. The Hacker News has contacted CERT Polska and MikroTik for comment on the technical analysis.
For readers who need the original analysis: The Hacker News — MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key
