MikroTik RouterOS SSH Login Argument Injection via Username '-2'

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•9

Detects anomalous SSH login attempts using the username '-2', which exploits a known argument-injection vulnerability (CVE-2026-86060) in MikroTik RouterOS. This vulnerability allows an attacker to bypass authentication and obtain unauthorized administrative privileges by forcing the login process to read privilege levels from the terminal file descriptor.