MikroTrick Exploitation of MikroTik RouterOS SSH

In September 2026, CERT Polska identified a critical exploit chain named 'MikroTrick' targeting MikroTik RouterOS devices. The chain consists of two primary vulnerabilities: CVE-2026-67279, which allows an unauthenticated SSH client to bypass the authentication phase via a rekeying flaw, and CVE-2026-86060, which enables privilege escalation by injecting command-line arguments into the login process. Attacks have been observed in the wild since at least September 2, 2026.

Technical analysis reveals that attackers utilize the username '-2' to trick the system into reading privilege levels from the terminal file descriptor, where the attacker has already placed a 'full' privilege mask. This allows for the creation of unauthorized administrative accounts, such as 'ops', and the exfiltration of sensitive diagnostic (.rif) files containing device configurations.

Impacted sectors include any organization utilizing MikroTik hardware exposed to the internet via SSH. The vulnerability has been added to the CISA KEV catalog, emphasizing the urgency for immediate patching to RouterOS versions 6.49.21, 7.23.4, 7.24.2, or later. Organizations should also leverage the new 'Flagged' mechanism in updated releases to check for existing signs of compromise.