Researchers expose MikroTik RouterOS devices to critical takeover threat via combined SSH flaws

A new attack chain named MikroTrick, combining two SSH-related flaws in MikroTik RouterOS, enables full administrative access without authentication, prompting urgent patches and mitigation steps.

MikroTik RouterOS devices exposed over SSH are facing a serious takeover risk after researchers tied two flaws together into a working attack chain that can deliver full administrative access without a password, key or completed login. CERT Polska has named the chain MikroTrick and said it combines an SSH state-machine flaw with an argument-injection bug in the RouterOS login process.

According to CERT Polska’s analysis, the first weakness allows an attacker to push an SSH connection past authentication at the wrong moment by triggering key renegotiation during the login sequence. The second flaw then turns that unauthenticated access into control of the console by passing a malicious username into the login programme as if it were a command-line option. In the observed attacks, the username “-2” caused the login process to read attacker-controlled values from the terminal and accept a privileged session.

The research indicates that exploitation was already under way before MikroTik’s patches arrived. CERT Polska said attack logs were visible from at least 2 September, while the vendor shipped fixes on 3 September in RouterOS 6.49.21, 7.23.4 and 7.24.2. The group added that a failed login for user “-2” is a distinctive sign of the chain, and that some affected devices showed the creation of an administrative account called “ops” before data was transferred to an external address.

The advisory also corrects a point that has appeared in some coverage. CERT Polska said the MikroTrick chain is specifically the combination of CVE-2026-67279 and CVE-2026-86060, not a third flaw. It described CVE-2026-67276 as a separate SSH issue that can let an attacker forge an RSA key to log in as an existing user, but only if the account name and public key are already known.

CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalogue on 10 September, reinforcing the view that the argument-injection flaw is being actively abused. MikroTik says its default home configuration does not expose SSH to the public internet, but devices with relaxed firewall rules or SSH reachable from untrusted networks face greater risk. CERT Polska advises administrators to patch immediately, inspect logs and device configuration for unknown users, scheduler entries, tunnels, proxies or unexpected diagnostic files, and rebuild compromised devices from trusted backups rather than restoring data from a suspect system.