MikroTrick Attack Lets Hackers Gain Full Admin Control of MikroTik Routers Without Login
Bishop Fox's MikroTrick chains CVE-2026-67279 and CVE-2026-86060 to gain unauthenticated admin control of internet-exposed MikroTik RouterOS devices, with compromise evidence.
MikroTrick chains CVE-2026-67279, an SSH rekeying flaw letting unauthenticated clients reach post-authentication functions, with CVE-2026-86060, where dash-prefixed usernames make a helper load a trusted identity record granting full administrator access on RouterOS 7.x builds. Bishop Fox reproduced full passwordless takeover and found configuration artifacts on internet-facing devices, indicating exploitation began before the flaws became public. Fixes shipped in RouterOS 6.49.21, 7.23.4, and 7.24.2; observed persistence includes a 'logrotate' script and 'daily-maint' scheduler recreating a privileged account with owner="0".
- Chained SSH flaws yield unauthenticated full admin control on RouterOS 7.x
- Rekeying bypass also affects 6.x, but full takeover was not reproduced there
- IoCs: logrotate script, daily-maint scheduler at 03:00, owner="0" artifacts
- Patching blocks new attacks but does not evict intruders already established
- Treat exposed routers as compromised; rotate secrets and restrict SSH
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078.003 Local AccountsT1136.001 Create Account: Local AccountT1053.003 Scheduled Task/Job: Cron
- Vendors
- MikroTik
- Products
- RouterOS
- Organizations
- Bishop Fox
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86060+1 related CVE | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 group max | 6% | KEVPoC ×3 | KEV |
From the original article
4 min read at cybersecuritynews.com
MikroTik router owners face a security problem after researchers reproduced a takeover chain that can hand an outsider full administrator control without a password. The attack, MikroTrick, targets exposed RouterOS devices through SSH and can turn a network gateway into an attacker-controlled foothold. The risk is serious because a router handles traffic entering and leaving […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.