Attackers can combine two MikroTik RouterOS vulnerabilities to gain administrator-level access to exposed routers without a password.
Security researchers at Bishop Fox reproduced the attack chain and found artifacts on real devices that suggest attackers exploited the flaws before public fixes became available.
The issue is especially serious because routers handle traffic between internal networks and the internet.
A compromised MikroTik device could allow attackers to monitor traffic, steal credentials, maintain access, or move deeper into connected networks.
CERT Polska disclosed six actively exploited RouterOS flaws on September 5, 2026. Two of them, tracked as CVE-2026-67279 and CVE-2026-86060, can be chained in an attack known as “MikroTrick.” MikroTik released fixes for all six issues.
MikroTik Flaws Enable Admin Access
The first flaw, CVE-2026-67279, affects how RouterOS processes SSH rekeying. Rekeying is a normal SSH operation that replaces encryption keys during a connection.
Under normal conditions, SSH follows three steps: establish encryption, authenticate the user, and then permit session activity such as terminal access or command execution.
On vulnerable RouterOS versions, an unauthenticated client could request a rekey and cause the device to move into a later connection state without completing user authentication.
This does not immediately create an administrator session. However, it allows the remote connection to access functions that should only be available after login.
Bishop Fox confirmed that affected RouterOS 6.x and 7.x versions could be pushed into this invalid authentication state.
CERT Polska also reported that the unauthenticated path could be used to manipulate files in the RouterOS-managed file area. Such files may contain configuration or diagnostic information.
The issue was fixed by adding a check that verifies the session has an assigned policy before RouterOS processes connection-layer requests. A session that has not authenticated will not have this policy, so the device now rejects the request.
The second flaw, CVE-2026-86060, exists in the RouterOS SSH login process. RouterOS sends the username provided by an SSH client to a helper program that establishes the user identity and access permissions.
[VULNERABLE] router.example.net:22
control (no rekey): refused [Unable to open channel.]
test (rekey) : opened [channel opened without userauth (SSH-2.0-ROSSSH)]That helper includes a legacy feature for trusted local programs. A specially formatted argument beginning with a dash can instruct the helper to read identity data from an already-open file descriptor instead of treating the value as a normal username.
The SSH service failed to block this special syntax from remote users. On vulnerable RouterOS 7.x devices, an attacker could supply a crafted username and send a trusted-looking identity record through the active terminal connection.
The helper could then interpret that data as an administrator identity with full permissions, bypassing normal authentication.
MikroTik fixed the issue by validating usernames before the login helper is called. Patched versions reject empty usernames, leading dashes, spaces in restricted positions, and control characters, bishopfox said.
Bishop Fox also found persistent artifacts on internet-facing routers, including unexpected privileged accounts, scripts, and scheduled tasks.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
