Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”
MikroTik RouterOS SSH auth-bypass chain MikroTrick (CVE-2026-67276 plus CVE-2026-86060) is actively exploited; patch to 7.24.2/7.23.5/6.49.21.
Attackers are actively exploiting a chain dubbed MikroTrick that combines CVE-2026-67276 (CVSS 9.2), an SSH authentication bypass in RouterOS RSA public key verification, and CVE-2026-86060, an SSH session privilege escalation, giving full admin control of internet-exposed MikroTik devices without the private key. Exploitation began around September 2, 2026, a day before MikroTik's September 3 patches, with confirmed compromises including creation of an 'ops' account; attacks traced to IPs 82.192.72.4 (Leaseweb) and 103.102.31.18. Fixed versions include 7.25beta3, 7.24.2, 7.23.4, 7.23.5 and 6.49.21. Defenders should check logs for failed logins with username '-2' and inspect /system history for ssh:-2@<IP> entries attached to configuration changes.
- MikroTrick chains CVE-2026-67276 auth bypass with CVE-2026-86060 privilege escalation
- Active exploitation observed since September 2, 2026, before patches shipped
- Fixes in RouterOS 7.24.2, 7.23.4/7.23.5, and 6.49.21
- IOC: username '-2' in SSH logs and creation of an 'ops' account
- Attack infrastructure: 82.192.72.4 (Leaseweb) and 103.102.31.18
- Products
- RouterOS
- Malware
- MikroTrick
- Organizations
- CERT Polska
- Countries
- Poland
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86060+1 related CVE | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 | 6% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.102.31.18 | her files: ftpsrv.py, launch.sh, and serve.py. A second IP, 103.102.31[.]18, has also been associated with the campaign. Three of the |
| ipv4 | 82.192.72.4 | mber 2. Most of the attacks observed so far originated from 82.192.72[.]4, a Leaseweb IP that was hosting a busybox binary (a MIPS |
| sha256 | 6dca83338d60467b65b7789d4d59754e40a7aaa36f40ea2da57538367ac9b89e | b8476b410b8f39fbedee8a3b0c745d6e3b328d7dcd (launch.sh), and 6dca83338d60467b65b7789d4d59754e40a7aaa36f40ea2da57538367ac9b89e (serve.py). Follow me on Twitter: @securityaffairs and Face |
| sha256 | 6e95f70fdbabb57881b3f5b2c8465d4b17ba901100704efb1278bb3386e6729d | nalysis: IPs 82.192.72[.]4 and 103.102.31[.]18; file hashes 6e95f70fdbabb57881b3f5b2c8465d4b17ba901100704efb1278bb3386e6729d (ftpsrv.py), 972b474b896f9fac3cd6b5b8476b410b8f39fbedee8a3b |
| sha256 | 972b474b896f9fac3cd6b5b8476b410b8f39fbedee8a3b0c745d6e3b328d7dcd | b3f5b2c8465d4b17ba901100704efb1278bb3386e6729d (ftpsrv.py), 972b474b896f9fac3cd6b5b8476b410b8f39fbedee8a3b0c745d6e3b328d7dcd (launch.sh), and 6dca83338d60467b65b7789d4d59754e40a7aaa36f |
From the original article
3 min read at securityaffairs.com
MikroTik RouterOS SSH zero-day (MikroTrick chain) under active exploitation since Sept 2. Patch to 7. 24.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.