The MikroTrick chain opens the RouterOS admin console with no password or SSH key

September 2, 2026. Logs on the MikroTik forum show failed SSH logins for the user -2 — a username that begins with a hyphen, which no administrator ever types. September 3, 2026. MikroTik ships RouterOS 6.49.21, 7.23.4 and 7.24.2, fixing two SSH flaws. September 25, 2026. CISA adds CVE-2026-67279 to its KEV catalog of actively exploited vulnerabilities, with a remediation due date of September 28, 2026. Why it matters: chained together, these two flaws — dubbed MikroTrick by CERT Polska — open a full administrative console on an internet-exposed RouterOS router, with no password, no SSH key, and no completed authentication.

A chain that skips the three steps of SSH

The SSH protocol advances through three ordered steps. It first establishes an encrypted connection, then authenticates the user, and only then allows the client to open a session and run commands. The server confirms a successful login with a dedicated message, SSH_MSG_USERAUTH_SUCCESS. MikroTrick crosses that barrier without ever proving its identity.

Bishop Fox reproduced the complete takeover on vulnerable RouterOS 7.x builds. Researcher Emilio Gallegos captures the danger in one line: “MikroTrick combines two failures at different trust boundaries. The first allows an unauthenticated connection to reach functionality that RouterOS should expose only after login. The second causes the login process to treat data from that connection as a trusted administrative identity.” This is exactly the kind of combination a single-vulnerability audit will never catch.

First link: CVE-2026-67279, the state machine that forgets authentication

CVE-2026-67279 is an improper enforcement of behavioral workflow (CWE-841) in the RouterOS SSH state machine. If a client starts an SSH key renegotiation during the authentication phase, the vulnerable RouterOS jumps straight to the command phase once the renegotiation finishes, without ever confirming the user’s identity.

On its own, the flaw does not create an authenticated session and grants no privileges. But it places an unauthenticated client at a stage that should only be reachable after a completed login. That is the door left ajar. The second link turns it into a door swung wide open.

Second link: CVE-2026-86060, the “-2” username that became an option

CVE-2026-86060 is an argument-injection flaw (CWE-88, CVSS 9.8) in the RouterOS login process. The system launches /nova/bin/login, passing it the username and a privilege level received from the SSH daemon as command-line arguments — without checking the username first.

A value that begins with a hyphen is then treated as a program option rather than a name. The attacker sends -2 as the username. The login program interprets that -2 as an instruction to read its identity and privilege level from file descriptor 2, which points to the terminal created by the SSH session. Through the SSH channel, the attacker has already written into that terminal a chosen username and the privilege value for full administrative access. The login program accepts both and opens a fully privileged console.

In other words, CVE-2026-67279 drops the authentication check, and CVE-2026-86060 turns the opening into an effective root session. CERT Polska puts it plainly: “Combining the two vulnerabilities resulted in full unauthenticated access to the administrative console.”

Exploitation documented before the patch even shipped

The chain leaves a distinctive trace in logs: a failed login attempt for the user -2. CERT Polska says logs matching this pattern appeared on the MikroTik forum as early as September 2, 2026 — one day before the patches became available. A diagnostic report posted to the forum shows the attack sequence on one device: rejected authentication for -2, a forced renegotiation, a jump to the channel phase, then an exec request attempting to create a user called ops with full privileges.

On that device, the SSH process crashed before the command completed. On others, reports confirm the ops account was successfully created. In several incidents, CERT Polska observed diagnostic-file creation followed by data transfers to an attacker-controlled IP address, suggesting configuration exfiltration.

CISA added CVE-2026-86060 to its KEV catalog on September 10, 2026, independently confirming active exploitation of the argument-injection flaw. The addition of CVE-2026-67279 on September 25, 2026 closes the loop: both halves of the chain are now officially recognized as exploited.

What to check on your routers

Patching stops the attack, but it does not undo changes an attacker made before the update. After moving to 6.49.21, 7.23.4 or 7.24.2, MikroTik and CERT Polska recommend checking the Flagged status:

/system/device-mode/print

The Flagged mechanism only detects a subset of compromise traces; its absence does not prove a device is clean. CERT Polska published these indicators observed in real attacks:

• Username -2 in SSH login logs
• Account ops in the full privilege group
• IP 82.192.72.4 observed in successful attacks
• IP 103.102.31.18 used in exploitation attempts

Also look for unknown users, scripts, scheduler entries, tunnels, proxies, unexpected .rif diagnostic files, or unexplained fetch activity. If any of these indicators are present, CERT Polska recommends isolating the device, preserving its logs and configuration, factory resetting it, and rebuilding from a trusted configuration. All passwords and keys should be changed, and a backup taken from a compromised device should never be restored.

RouterOS, a structural botnet target

This chain is not an isolated accident: RouterOS is one of the most targeted platforms for botnets, for a simple reason — it concentrates hundreds of thousands of edge devices that are often exposed and rarely updated. The Mēris botnet, back in 2021, already enlisted nearly 200,000 MikroTik devices for DDoS attacks reaching tens of terabits per second. In 2023, CVE-2023-30799 — a privilege escalation from the admin user to root — was exploited to deploy backdoors.

MikroTrick follows the same logic, with greater severity: where Mēris relied on weak passwords or misconfiguration, MikroTrick bypasses authentication itself. MikroTik notes that its default home configuration does not expose SSH to the internet, but administrators who changed their firewall rules or manage devices over SSH from untrusted networks are squarely in scope. No authoritative count of compromised devices has been published so far.

The cheapest fix is exposure reduction

Beyond patching, the cleanest long-term control is to shrink the attack surface. If SSH is only needed for management, bind it to a dedicated management interface or an allowlist rather than leaving it reachable on the WAN; MikroTik’s own device-mode and firewall defaults already assume SSH is not internet-exposed. A router that never exposes SSH to the public cannot be reached by this chain, no matter how many flaws sit in its login path. Patching removes the bug, but only reducing exposure removes the route.

Verdict

If you run exposed MikroTik routers — even indirectly, through a firewall rule that lets SSH through — apply 6.49.21, 7.23.4 or 7.24.2 now, then run /system/device-mode/print and hunt for the -2 and ops indicators before anything else. If your devices do not need externally reachable SSH, disable the service or restrict it to an allowlist of management addresses: that mitigation cancels the chain regardless of patch level. If you manage a heterogeneous fleet, treat the IoC sweep as a campaign of its own — a patched but already compromised device is still an open backdoor. MikroTrick is a blunt reminder that a “minor” state-machine flaw only becomes critical when a second flaw turns it into a trusted identity: it is the chain, not the flaw, you must defend.

References

• The Hacker News — MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key (September 23, 2026)
• The Hacker News — SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild (September 26, 2026)
• NVD — CVE-2026-67279
• NVD — CVE-2026-86060
• CISA — Known Exploited Vulnerabilities Catalog