Vulnerabilities

CERT Polska, Poland's national computer emergency response team, has named a MikroTik RouterOS attack chain "MikroTrick." It pairs CVE-2026-67279, a flaw in how the SSH server handles a mid-authentication key renegotiation, with CVE-2026-86060, an argument injection bug in RouterOS's login process. Together they let an attacker with no account, no password and no valid SSH key reach a full administrative session on any internet-facing RouterOS device running an unpatched build.

Attack logs CERT Polska reviewed show the chain in use from September 2, 2026, a day before MikroTik shipped fixed builds on September 3. CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities (KEV) catalog on September 10, and CVE-2026-67279 followed on September 25. A Shadowserver Foundation scan the same week found around 122,500 RouterOS devices with SSH reachable from the public internet, every one a candidate victim until patched.

Why an edge device is worth this much effort

A router or firewall sits between the internet and everything else, which is exactly why it gets less scrutiny than the servers behind it. Server patching gets a change ticket and a maintenance window; the edge box that has run untouched for two years rarely does. RouterOS ships in home routers, branch office links and ISP infrastructure, so a working unauthenticated exploit against it reaches an unusually wide, unusually unwatched set of targets in one release.

How it works

SSH connections start with a key exchange that both sides use to derive a shared encryption key. Either side can ask to redo that exchange mid-session, a step called a rekey, without dropping the connection; it exists so that a long-lived session, or one carrying a lot of data, is not encrypted under one key indefinitely. A client is allowed to request a rekey at almost any point, including while the server is still waiting for it to log in.

CVE-2026-67279 is what happens when a vulnerable RouterOS build gets that timing wrong. If a client sends a rekey request during the authentication step, the server processes it correctly, but once the rekey finishes, it moves straight into channel handling, the phase where an authenticated client opens a shell or runs commands. It does this without ever sending SSH_MSG_USERAUTH_SUCCESS, the protocol message that is supposed to mark a login as complete. An unauthenticated client that times a rekey request this way lands in the post-login phase anyway, and CERT Polska rates this alone at CVSS 6.9: it is enough to open a session channel and create, overwrite or rebuild files, but it does not by itself hand over an admin account.

That is where CVE-2026-86060 (CVSS 9.2) comes in. RouterOS's SSH login handler runs an internal process, /nova/bin/login, that takes the connecting username as one of its command-line arguments and uses it to look up the account's privilege level, which RouterOS calls a policy mask. The handler does not reject usernames that start with a dash. A username of -2 is read as a reference to file descriptor 2, the session's own pseudoterminal, instead of a literal name, and an attacker who controls what gets written there can feed the login process a forged policy mask claiming full administrator rights. Chained with the rekey bypass, the two bugs let a single unauthenticated SSH connection walk straight past the login prompt and out the other side with an admin session.

What attackers are doing

CERT Polska disclosed MikroTrick alongside four other RouterOS SSH vulnerabilities on September 5, three days after the earliest confirmed exploitation and two days after MikroTik's patch. eSecurity Planet, citing CERT Polska's data, names two source addresses seen in the earliest successful attacks, 82.192.72.4 and 103.102.31.18. That two-day gap between exploitation starting and a fix existing makes this a genuine zero-day attack, not just a fast follow on a public advisory.

CISA's KEV listings for this story do not line up as cleanly as the CVE numbers suggest. On September 10, CISA added CVE-2026-86060 together with CVE-2026-67277, giving federal agencies until September 13. CVE-2026-67277 is a separate, unrelated flaw in RouterOS's bandwidth-test service that leaks kernel memory and can crash the device; its number is one digit off from CVE-2026-67279, and at least one write-up (Rescana) has run the two together. The rekey bug that actually completes the MikroTrick chain, CVE-2026-67279, was not added to KEV until September 25, with a September 28 deadline. If you are checking your patch record against the KEV catalog, confirm you have both 86060 and 67279, not 67277.

A router taken over this way gives an attacker everything an admin session gives a legitimate operator: it can intercept and redirect traffic passing through it, change the DNS servers handed to every device on the LAN, add firewall or NAT rules that tunnel traffic elsewhere, and serve as a pivot point into whatever network sits behind it.

What to do

1. Patch. The fixed builds are RouterOS 6.49.21 on the long-term 6.x branch, 7.23.4 on the long-term 7.x branch, 7.24.2 on the stable branch, and 7.25beta3 on the beta channel. Update from Winbox or WebFig under System > Packages, or run /system package update check-for-updates followed by /system package update install. Patch every RouterOS device with SSH enabled, not only your edge routers; the flaw is in the SSH server itself.

2. If you cannot patch today. Take SSH, WWW/WWW-SSL and the bandwidth-test service off the WAN entirely; that is CERT Polska's own interim advice. In /ip service, restrict the SSH entry to your management network or VPN range, for example /ip service set ssh address=203.0.113.0/24, and add a matching drop rule for your WAN interface list in /ip firewall filter so the restriction holds even if the service address gets reset. For remote administration, use RouterOS's built-in WireGuard rather than opening SSH to the internet at all.

3. Check whether you were hit. Run /user print and look for any admin account you did not create. Check /system scheduler print and /system script print for jobs you do not recognize, especially ones set to run on boot. Review /ip firewall filter print and /ip firewall nat print for redirect, masquerade or new accept rules nobody on your team added. Compare your SSH host key fingerprint against the one you have on file; a changed fingerprint on a device you did not touch means someone else touched it. Read /log print for login entries with unfamiliar usernames or source addresses, remembering that an attacker with admin rights can edit these logs too.

4. If you find signs of compromise. Do not trust the device's current configuration or its own backups; MikroTik and CERT Polska both advise rebuilding from a configuration saved before the exposure window, not from what is on the router now. Rotate every credential the device held: admin account passwords, API keys used by monitoring or automation tools that talk to it, VPN pre-shared keys and WireGuard private keys configured on it, and RADIUS or hotspot secrets. Treat the whole saved configuration as read by the attacker, because an admin session gives access to export it in full.

Our network penetration tests check exactly this kind of exposed management surface on routers and firewalls, and our attack surface management work keeps track of which of your devices still have SSH or Winbox open to the internet. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: CERT Polska: MikroTrick technical analysis, CERT Polska: vulnerabilities in MikroTik RouterOS, CISA: known exploited vulnerabilities catalog, CISA: two vulnerabilities added, September 25, 2026, eSecurity Planet, Cybernews, Rescana, The Hacker News.