MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key
Attackers chained two MikroTik RouterOS SSH flaws to seize internet-exposed routers without authentication; CISA lists one in KEV.
CERT Polska detailed MikroTrick, a chain of CVE-2026-67279 and CVE-2026-86060 that gives unauthenticated full administrative control of MikroTik RouterOS devices with SSH exposed to the internet. Exploitation logs appeared by September 2, 2026, one day before patches in RouterOS 6.49.21, 7.23.4, and 7.24.2. CISA added CVE-2026-86060 to the Known Exploited Vulnerabilities catalog on September 10. Attackers created a privileged user named ops; a separate flaw, CVE-2026-67276, is not part of the chain.
- CVE-2026-67279 lets an SSH client reach commands without completed authentication.
- CVE-2026-86060 turns that access into full administrative control.
- Exploitation evidence predates September 3 patches; CISA listed CVE-2026-86060 on September 10.
- Indicators include username -2, account ops, and IPs 82.192.72.4 and 103.102.31.18.
- Patching does not remove prior changes; reset and rotate credentials if indicators appear.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1136.001 Create Account: Local AccountT1048 Exfiltration Over Alternative Protocol
- Vendors
- MikroTik
- Products
- RouterOS
- Organizations
- CERT PolskaCISAOpenAI
- AI models
- GPT-5.5-cyberGPT-5.6-sol
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86060+2 related CVEs | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 group max | 6% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.102.31.18 | roup IP : 82.192.72.4 (observed in successful attacks) IP : 103.102.31.18 (used in exploitation attempts) Administrators should also |
| ipv4 | 82.192.72.4 | H login logs Account : ops in the full privilege group IP : 82.192.72.4 (observed in successful attacks) IP : 103.102.31.18 (used i |
From the original article
4 min read at thehackernews.com
Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.