Ethical Hacking News
The MikroTrick Chain: Uncovering the Complex Vulnerability Exploited to Take Over MikroTik Routers Without a Password or SSH Key
A new vulnerability has been discovered in MikroTik routers, allowing attackers to take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The vulnerability, dubbed the "MikroTrick Chain," is a complex chain of two separate issues that can be chained together to grant attackers a level of access that would otherwise be unthinkable. This article provides a detailed explanation of the vulnerability, its impact, and the steps that organizations can take to protect themselves.
MikroTik RouterOS has been affected by a severe vulnerability known as the "MikroTrick Chain", which allows attackers to gain full administrative control of the device without a password, SSH key, or completed authentication. The vulnerability consists of two separate issues, CVE-2026-67279 and CVE-2026-86060, which can be chained together to grant attackers a high level of access. The first vulnerability, CVE-2026-67279, allows an unauthenticated client to bypass the authentication process and reach the command phase prematurely. The second vulnerability, CVE-2026-86060, is an argument-injection bug in the RouterOS login process that enables attackers to gain full administrative control of the device. Pre-patch exploitation of the MikroTrick chain has been observed, with failed login attempts detected in device logs and a diagnostic report showing the attack sequence on one device. Patching the device immediately is essential to mitigate the risk of this vulnerability, but administrators should also check for signs of compromise and ensure secure firewall rules and SSH settings.
The cybersecurity landscape has recently been rocked by a concerning discovery regarding the MikroTik RouterOS, a popular device used by numerous organizations worldwide. A newly identified vulnerability, dubbed the "MikroTrick Chain," has been found to allow attackers to take full administrative control of Internet-exposed routers without the need for a password, SSH key, or completed authentication. This complex vulnerability chain, comprising of two separate issues, CVE-2026-67279 and CVE-2026-86060, can be chained together to grant attackers a level of access that would otherwise be unthinkable.
According to the information provided, CVE-2026-67279 is a vulnerability in the SSH state-machine, which allows an unauthenticated client to bypass the authentication process and reach the command phase prematurely. This vulnerability, when combined with CVE-2026-86060, an argument-injection bug in the RouterOS login process, enables attackers to gain full administrative control of the device. The chain of events begins when an attacker starts an SSH key renegotiation during the authentication step, causing the vulnerable RouterOS to move directly to the command phase when the renegotiation finishes. This allows the attacker to access a stage that should require a completed login, effectively rendering the authentication process useless.
CVE-2026-86060, on the other hand, is a vulnerability that turns the previously described access into full administrative control. The RouterOS login program, which receives the username and privilege level from the SSH daemon as command-line arguments, fails to check the username first. When an attacker sends a value beginning with a hyphen as the username, the login program treats it as a program option rather than a name, and accepts both the username and the privilege value for full administrative access to the terminal. This allows the attacker to open a fully privileged console, effectively granting them administrative control of the device.
The evidence of pre-patch exploitation of the MikroTrick chain can be seen in the device logs, which display a failed login attempt for the username "-2". This pattern of failed login attempts was observed on the MikroTik forum as early as September 2, one day before the patches became available, and is believed to have been exploited before MikroTik released the fixes. A diagnostic report on the MikroTik forum shows the attack sequence on one device, including a rejected authentication for "-2", a forced renegotiation, a jump to the channel phase, and an exec request attempting to create a user called "ops" with full privileges. The SSH process crashed before the command completed on that device, but in some incidents, the "ops" account was successfully created on affected devices.
The MikroTrick chain is a concerning discovery, especially given that it requires SSH to be reachable from the attacker. MikroTik has stated that its default home configuration does not expose SSH to the Internet, but administrators who changed their firewall rules or manage devices over SSH from untrusted networks face a higher risk. No authoritative count of compromised devices has been published, making it difficult to assess the full extent of the vulnerability.
To mitigate the risk of this vulnerability, it is essential to patch the device immediately. However, patching does not remove changes that an attacker made before the update, so administrators should check the Flagged status by running /system/device-mode/print after updating. The Flagged mechanism detects only selected traces of compromise and does not prove that the device is safe. Therefore, administrators should also check for unknown users, scripts, scheduler entries, tunnels, proxies, unexpected .rif diagnostic files, or unexplained fetch activity.
In light of this discovery, it is essential for organizations that use MikroTik routers to take immediate action to protect themselves. This includes patching the device as soon as possible, checking for any signs of compromise, and ensuring that their firewall rules and SSH settings are configured securely. By taking these steps, organizations can minimize the risk of falling victim to the MikroTrick chain and protect their networks from this complex vulnerability.
Related Information:
https://www.ethicalhackingnews.com/articles/MikroTrick-Chain-Uncovering-the-Complex-Vulnerability-Exploited-to-Take-Over-MikroTik-Routers-Without-a-Password-or-SSH-Key-ehn.shtml
https://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html
https://nvd.nist.gov/vuln/detail/CVE-2026-67279
https://www.cvedetails.com/cve/CVE-2026-67279/
https://nvd.nist.gov/vuln/detail/CVE-2026-86060
https://www.cvedetails.com/cve/CVE-2026-86060/
Published: Wed Sep 23 13:38:18 2026 by llama3.2 3B Q4_K_M
