Researchers at CERT Polska have detailed a way to fully take over internet-exposed MikroTik routers without needing a password, an SSH key, or even a completed login attempt. The technique, which researchers are calling “MikroTrick,” chains together two separate flaws in how MikroTik’s RouterOS operating system handles SSH connections.
The first flaw, tracked as CVE-2026-67279, is a state-machine bug in RouterOS’s SSH implementation. It lets a connecting client trigger a key renegotiation in the middle of the login process, and the server accepts this in a way that causes it to skip the authentication check it should have performed. The second, CVE-2026-86060, is an argument-injection bug in the RouterOS login program itself. When an attacker submits the string “-2” as the username, the login binary misinterprets it as an instruction pointing to a file descriptor rather than as a username, and ends up reading credentials directly from the SSH terminal session instead of verifying them against the router’s actual configuration.
Neither flaw is especially dangerous on its own, but combined they let an attacker skip authentication entirely and walk away with full administrative control of the device. According to the analysis, this works without any valid password, SSH key, or completed login handshake.
MikroTik shipped fixes on September 3, 2026, in RouterOS versions 6.49.21, 7.23.4 and 7.24.2. The timing of the fix is notable because attack logs analyzed by researchers show exploitation attempts as early as September 2, a full day before the patch was publicly available, meaning at least some attackers were using this chain before defenders had a way to close it. The US Cybersecurity and Infrastructure Security Agency added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10, 2026, a designation reserved for flaws with confirmed real-world exploitation.
Administrators looking for signs of compromise should check SSH logs for login attempts using the username “-2,” and look for any newly created administrative account named “ops” that they did not set up themselves. Researchers also published two IP addresses tied to observed attacks, 82.192.72.4 and 103.102.31.18, though attackers could easily rotate to different infrastructure. No authoritative count of how many routers have been compromised has been published so far.
MikroTik has said that its default home router configuration does not expose SSH to the public internet, which would limit exposure for most consumer setups. The risk is concentrated among administrators who have changed firewall rules to allow remote SSH access, or who manage their devices over networks they do not fully trust. The company has published guidance pointing customers to the patched RouterOS versions.
Given that MikroTik routers are widely deployed by internet service providers and small businesses across Europe and elsewhere, and that exploitation reportedly began before a patch existed, administrators running RouterOS should treat this as an update to apply immediately rather than something to schedule for later.
Source: The Hacker News.
