# MikroTrick: Dual SSH Flaws Enable Unauthenticated Takeover of RouterOS Devices
Security researchers have uncovered a severe chain of vulnerabilities affecting MikroTik RouterOS that allows attackers to seize complete administrative control of internet-facing routers. Dubbed MikroTrick, this exploit bypasses standard authentication mechanisms entirely, requiring neither a password nor an SSH key to execute commands with the highest privileges.
## The Two Vulnerabilities at the Core
The attack relies on two specific vulnerabilities working in tandem to override the standard SSH protocol flow.
The first flaw, tracked as CVE-2026-67279, targets the SSH state machine within RouterOS. During the authentication phase, if a client initiates an SSH key renegotiation, the vulnerable system fails to confirm the user’s identity and prematurely jumps straight to the command execution phase. On its own, this flaw does not grant access or create an authenticated session; it simply allows an unauthenticated client to reach a stage that should have required a completed login.
The second vulnerability, CVE-2026-86060, is an argument-injection flaw located in the RouterOS login process. When the login program is invoked, it receives the username and privilege level as command-line arguments without checking the username format first. An attacker can exploit this by sending a hyphen-prefixed value—specifically “-2″—as the username. The login program misinterprets this as a directive to read its identity and privilege level directly from the terminal input. Because the attacker has already manipulated the terminal session via the first flaw, they can dictate a full privilege level, ultimately opening a completely unrestricted administrative console.
## Exploitation Before the Patch
Evidence indicates that threat actors began exploiting this chain shortly before the official patches were rolled out. Logs of the attack, characterized by failed login attempts for the user “-2”, started appearing in online security forums as early as September 2, a full day before the security updates were released in RouterOS versions 6.49.21, 7.23.4, and 7.24.2.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) independently confirmed the active exploitation of the argument-injection flaw by adding it to its Known Exploited Vulnerabilities catalog on September 10.
## Signs of a Compromised Device
Even after patching, administrators must investigate whether the network has already been breached. Indicators of a prior MikroTrick attack include:
* Failed login entries for the username “-2” in SSH logs.
* The presence of a newly created “ops” account belonging to the full privilege group.
* Unexplained diagnostic file creation and unusual data transfers to external IP addresses.
* Unknown scripts, unexpected scheduler entries, or rogue proxy configurations.
## Mitigation and Recovery
Organizations should immediately apply the latest MikroTik patches to prevent future exploitation. If an attack is suspected, the affected device must be isolated from the network. A factory reset is necessary, followed by a rebuild from a known-good, trusted configuration backup. It is critical to change all passwords and cryptographic keys, as the attackers may have captured them during the compromise. Administrators should never restore a backup from a compromised device, as doing so would reinstate any malicious changes the attacker introduced.
It is worth noting that while MikroTik’s default home configuration does not expose SSH to the internet, administrators who altered their firewall rules or manage devices over SSH from untrusted networks face a significantly higher risk.
## Frequently Asked Questions (FAQ)
**What does MikroTrick actually accomplish?**
MikroTrick chains two separate SSH vulnerabilities to bypass authentication entirely, allowing an attacker to open a fully privileged administrative console on a MikroTik router without needing any credentials.
**Are both CVEs required for the attack?**
Yes. CVE-2026-67279 allows the attacker to reach the command phase without authentication, and CVE-2026-86060 allows them to pass malicious arguments to the login program to gain full administrative privileges.
**Is my device at risk?**
If your MikroTik router’s SSH service is reachable from the public internet, it is at risk. Custom firewall rules or management over untrusted networks significantly increase the exposure.
**Does patching fix an already compromised device?**
Patching prevents further exploitation, but it does not erase traces of a prior compromise. A factory reset and a rebuild from a clean configuration are required if the device was previously breached.
**What about CVE-2026-67276?**
This is a separate SSH vulnerability that allows an attacker to forge an RSA key to log in as an existing user. It is not part of the MikroTrick chain and requires prior knowledge of the account name and its public key.
## Conclusion
The MikroTrick vulnerability chain represents a critical threat to network infrastructure, as it allows unauthenticated attackers to take complete control of routers without any prior credentials. The speed at which this chain was exploited before patches were even available highlights the urgent need for timely patch management and rigorous network segmentation. Administrators must not only update their systems immediately but also conduct thorough forensic checks to ensure that no residual access remains. Proactive monitoring, strict firewall rules limiting SSH exposure, and immediate incident response are essential defenses against such sophisticated attacks.
Thank you for reading
