Full Report
We describe the technical details of the MikroTrick chain, which combines the CVE-2026-67279 and CVE-2026-86060 vulnerabilities and, when chained, allowed full takeover of a device without authentication. We explain the mechanics of the attacks observed in the wild, the coordinated disclosure of both vulnerabilities, and the practical role of LLM agents in the RouterOS research.
Analysis Summary
# Vulnerability: MikroTrick (SSH Authentication Bypass Chain)
## CVE Details
- **CVE ID:** CVE-2026-86060 & CVE-2026-67279
- **CVSS Score:** 10.0 (Critical) - *Estimated based on unauthenticated full takeover*
- **CWE:** CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
## Affected Systems
- **Products:** MikroTik RouterOS
- **Versions:**
- RouterOS v7.x prior to 7.25beta3, 7.24.2, 7.23.4
- RouterOS v6.x prior to 6.49.21
- **Configurations:** Systems with SSH service enabled and reachable from the network.
## Vulnerability Description
The "MikroTrick" chain involves two primary flaws:
1. **CVE-2026-86060 (Argument Injection):** The SSH server failed to validate usernames before passing them to the `/nova/bin/login` application. Specifically, usernames beginning with a hyphen (e.g., `-2`) were interpreted as command-line arguments rather than string literals.
2. **CVE-2026-67279 (Logic Flaw):** By injecting the argument `-2`, attackers could manipulate the file descriptor handling within the login process.
When chained, these allow an attacker to bypass the standard authentication flow (passwords or SSH keys) and execute administrative commands directly.
## Exploitation
- **Status:** Exploited in the wild.
- **Complexity:** Medium (Requires understanding of RouterOS internals, but PoCs were developed by researchers within hours of patch release).
- **Attack Vector:** Network (Remote via SSH).
## Impact
- **Confidentiality:** High (Full access to device configuration and traffic).
- **Integrity:** High (Ability to add malicious administrative users and modify system behavior).
- **Availability:** High (Ability to disable the device or change routing).
## Remediation
### Patches
Update to the following versions or newer:
- **RouterOS v7:** 7.25beta3, 7.24.2, or 7.23.4
- **RouterOS v6:** 6.49.21
### Workarounds
- Restrict SSH access (port 22) to trusted IP addresses only using firewall rules.
- Disable the SSH service if not required for remote management.
## Detection
- **Indicators of Compromise (IoCs):**
- Logs showing `login failure for user -2 from [IP] via ssh` followed immediately by successful configuration changes.
- Presence of an unexpected account named `ops` belonging to the `full` group.
- Log entries: `user ops added by ssh:[email protected]`.
- **Detection methods:**
- Check the `Flagged` status in RouterOS, which the vendor updated to detect the `ops` account automatically at startup.
- Review system logs for any login attempts involving usernames starting with a hyphen or space.
## References
- [Vendor Advisory: MikroTik Security Update] - hxxps://forum[.]mikrotik[.]com/t/important-security-update/272851
- [CISA KEV Catalog] - hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- [CERT Polska Analysis] - hxxps://cert[.]pl/en/posts/2026/09/mikrotrick-analysis/
- [CVE-2026-86060 Record] - hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-86060
- [CVE-2026-67279 Record] - hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-67279