A newly identified exploit chain dubbed “MikroTrick” allows attackers to take full administrative control of MikroTik routers without any password, SSH key, or full login. The attack leverages two critical RouterOS vulnerabilities—CVE-2026-67279 and CVE-2026-86060—that, when used in combination, completely bypass normal authentication and elevate privileges to the highest level.
What the Flaws Do
The first flaw, CVE-2026-67279, affects the SSH state machine in RouterOS. If a client begins SSH key renegotiation during the authentication phase, a vulnerable router skips over proper identity verification once renegotiation ends and moves directly into the command-execution phase. On its own, this does not grant full access—but it opens the door for the second flaw to take over.
CVE-2026-86060 takes advantage of how RouterOS handles login arguments when starting its login helper process. If a supplied username begins with a hyphen (“-“), the system treats it as an option rather than a name. An attacker using “-2” as the username can force the login system to use data from a file descriptor tied to the SSH session to supply a username and privilege mask, which can be manipulated to obtain full administrative rights.
When It Hit & Which Versions Are Affected
Attack logs point to active misuse of this chain at least as far back as September 2, 2026—just one day before MikroTik published security updates for RouterOS versions 6.49.21, 7.23.4, and 7.24.2. Administrators who exposed SSH to the public internet are especially vulnerable. Versions earlier than those mentioned are considered affected. RouterOS 6.48 and anything older has no patched release in its line and must either be upgraded to 6.49.21 or move to an updated 7.x branch to be safe.
How to Detect Past or Present Compromise
Logs may show failed SSH login attempts for user “-2”. In successful attacks, a new user called “ops” has been created with full administrative privileges. Other red flags: unexpected diagnostic .rif files appearing on the device, config files accessed or fetched by unknown IPs (e.g. 82.192.72.4 or 103.102.31.18), abnormal scheduler jobs or scripts, or modified tunnels or proxies. Even if the device isn’t flagged, lack of the flagged state doesn’t prove safety.
MikroTik’s “Flagged” status, visible via the command /system/device-mode/print, can help indicate compromise but can’t guarantee it wasn’t tampered with before patching. After updating, users should manually inspect devices, change all credentials, and rebuild from trusted configurations rather than restoring from potentially compromised backups.
Patching & Mitigations
Affected users should upgrade immediately to one of the fixed versions: RouterOS 6.49.21, 7.23.4, 7.24.2 or newer in those branches. These versions patch both CVE-2026-67279 and CVE-2026-86060, as well as the related bandwidth-test vulnerability CVE-2026-67277. Users still on older builds or end-of-life lines (e.g. 6.48 or early 7.x) must migrate to these fixed builds or newer.
Until patching is complete, administrators should disable or block remote access to SSH, WebFig, bandwidth-test services, and other management interfaces from untrusted networks. Using restrictive firewalls, enabling VPN access for remote management, and segregating device management networks help reduce exposure.
This isn’t just another vulnerability—MikroTrick represents a concatenation of two high-severity flaws that on their own look moderate but together allow zero-authentication takeover. It’s a stark reminder that in network-hardware security, chain-attacks are rapidly becoming a major threat. For anyone running a MikroTik router, the safe bet is to assume you’re vulnerable, patch now, and audit your device for signs of intrusion. Watch for updates on whether more than these three RouterOS lines might have been unknowingly compromised.
