AI Helps Uncover MikroTrick Attack Chain in MikroTik RouterOS
MikroTrick chains two MikroTik RouterOS flaws for unauthenticated admin access, with exploitation seen before patches.
CERT Polska reconstructed MikroTrick, a chain of MikroTik RouterOS flaws CVE-2026-67279 and CVE-2026-86060 that yields full administrative access without authentication. An SSH rekey during login skips authentication, and an unsanitized username argument lets the attacker supply a fully privileged policy; logs show a failed login for user "-2" and creation of an "ops" admin account. MikroTik patched on September 3, 2026. CERT Polska says the chain was used before the patches, with source IP 82.192.72.4 pulling diagnostic files from compromised routers. Researchers used GPT-5.5-cyber and GPT-5.6-sol to help recover the bugs within days of the silent update.
- MikroTrick chains CVE-2026-67279 and CVE-2026-86060 into unauthenticated admin access.
- Logs show a failed "-2" login followed by a privileged "ops" account.
- CERT Polska ties attempts to 82.192.72.4, including stolen diagnostic files.
- MikroTik patched on September 3, 2026; public analysis followed within days.
- GPT-5.5-cyber and GPT-5.6-sol assisted binary and protocol analysis.
- Vendors
- MikroTik
- Products
- RouterOS
- Organizations
- CERT PolskaOpenAI
- AI models
- GPT-5.5-cyberGPT-5.6-sol
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86060+1 related CVE | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 group max | 6% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 82.192.72.4 | direct reports to CERT Polska show a consistent source IP, 82.192.72.4, repeatedly attempting this exact sequence, and in several |
From the original article
5 min read at securityaffairs.com
MikroTrick chains two RouterOS flaws to bypass authentication and gain admin access. AI helped researchers uncover the attack chain within days. MikroTik pushed out patches on September 3, 2026 for several RouterOS issues at once, calling it an important security update without saying what it actually fixed.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.