MikroTrick: Chained MikroTik RouterOS SSH Vulnerabilities Enable Unauthenticated Router Takeover

CERT Polska has identified and named the chained vulnerability affecting MikroTik RouterOS as MikroTrick. The exploit chain combines two distinct flaws in the RouterOS SSH implementation. The first, CVE-2026-67279, is a state-machine flaw within the SSH implementation. The second, CVE-2026-86060, is an argument-injection bug present in the RouterOS login process. By chaining these two vulnerabilities, attackers can bypass the authentication mechanism entirely. This means that an attacker does not need a valid password, an SSH key, or to complete the standard authentication process to gain administrative access to the router. The vulnerabilities primarily affect Internet-exposed MikroTik routers running RouterOS. The security advisory notes that the flaws allow for full administrative compromise of the affected devices. This level of access could enable threat actors to perform lateral movement within the network, intercept traffic, steal configurations, and establish a persistent foothold. MikroTik has released RouterOS version 7.0.4 and later versions which patch both CVE-2026-67279 and CVE-2026-86060. The vendor recommends that users update to the latest stable RouterOS version as soon as possible. As an immediate mitigation step, MikroTik advises disabling SSH access from the WAN interface if updating is not immediately feasible. CERT Polska disclosed the chain in September 2026, and exploitation is believed to be ongoing. The vulnerabilities have been assigned CVSS scores, though specific numerical values are referenced in the context of the overall severity of the chain. The global distribution of MikroTik routers means that the potential impact spans users worldwide, with a significant presence noted in Poland and Europe.