Mikro Trick Chain Let Attackers Take Over Mikro Tik Routers Without a Password or SSH Key

Summary: CERT Polska detailed a two-flaw chain, dubbed MikroTrick, that combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060) to give attackers full administrative control of Internet-exposed MikroTik routers without a password, SSH key, or completed authentication. Attack logs date to at least September 2, one day before MikroTik shipped patches in RouterOS 6.49.21, 7.23.4, and 7.24.2, and CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10.
What you should know: The chain leaves a failed login for user -2 in device logs, and CERT Polska found diagnostic-file creation followed by data transfers to an attacker IP address, strongly suggesting configuration data was copied out. Patching closes the hole but does not remove what attackers already did, and the Flagged status check detects only selected traces, so its absence does not prove a device is safe.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-67276 CVE-2026-67279 CVE-2026-86060
Related: Share Point RCE and Mikro Tik RouterOS Flaws Actively Exploited in the Wild Cyber Risks ·
CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability Known Exploited Vulnerabilities · Sep 25, 2026
CVE-2026-86060: Mikro Tik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability Known Exploited Vulnerabilities · Sep 10, 2026