When the Router Answers to a Stranger: MikroTik RouterOS and the MikroTrick SSH Chain

A router that accepts an SSH connection from anyone is not a convenience. It is a door. In September 2026, Poland's CERT Polska disclosed a chain in MikroTik RouterOS that turns an internet-exposed SSH service into full device takeover without a password, and confirmed it was already being used in the wild.

What the chain actually is

The chain, named MikroTrick, combines two flaws. CVE-2026-67276 is a missing authentication check in the SSH implementation: a crafted request can bypass the normal credential check. CVE-2026-86060 is an improper neutralization of argument delimiters, which lets a malformed username inject additional parameters and escalate to administrator level.

Neither flaw requires prior credentials. The precondition is simply that the SSH management service is reachable from the internet. CERT Polska coordinated the disclosure of six RouterOS vulnerabilities in total, of which these two are the critical ones.

What makes this different from a normal router bug

Edge routers sit at a specific point in the network. They are always on, they route traffic for everything behind them, and they are frequently the device that decides which traffic is trusted. An attacker who controls one gets several things at once:

• Traffic visibility and manipulation. Routing changes and DNS changes are within reach.
• A persistent foothold. New administrator accounts can be created and survive a reboot.
• A pivot point. The router is a natural place to stage activity that appears to originate from the organisation's own address space.

The practical consequence is that a compromised router is not a perimeter incident. It is an interior incident that happens to start at the perimeter.

Detection is more specific than usual

This incident produced unusually concrete indicators, which is worth using while they are fresh:

• SSH login attempts using the malformed username -2. This is a direct signature of the authentication-bypass attempt.
• Unexpected accounts, particularly one named ops.
• A device status marked Flagged. MikroTik added an automated detection and blocking mechanism in the patched releases; a flagged state means the device itself noticed something.

The Flagged indicator deserves emphasis. It is a vendor-provided signal rather than an inference, and it is the kind of thing that is easy to miss if nobody is looking at device status after an upgrade.

Remediation

1. Upgrade to a fixed RouterOS release. MikroTik published fixes across the maintained branches, including 6.49.21, 7.23.4 and 7.24.2.
2. Do not expose SSH management to the internet. Restrict it to a management network or VPN. If that is not immediately possible, restrict source addresses at the firewall.
3. Check for the indicators before assuming you are clean. Look for the -2 username pattern, unexpected accounts, and the Flagged status.
4. Treat a confirmed compromise as a device compromise, not a password problem. If an attacker had administrator control, changing the password does not remove accounts or configuration changes they created.
5. Review configuration for unauthorised changes. Routing entries, DNS settings, firewall rules and scheduled scripts are all worth reading line by line on a suspect device.

The pattern behind the incident

CERT Polska's advisory notes that the flaws were being used to take over devices whose SSH service was reachable from the internet. That phrasing matters. The vulnerability is in the software, but the exposure is a configuration decision, usually made for operational convenience and rarely revisited.

Remote management ports are opened so that someone can fix a problem at 2 a.m. without driving to a site. That is a real need. The question is whether the port needs to be reachable by the entire internet, or only by the people who administer it. For most organisations, the honest answer is the latter, and the difference between the two is a firewall rule.

References

• CERT Polska advisory on critical MikroTik RouterOS vulnerabilities under active exploitation, 5 September 2026
• NVD entries for CVE-2026-67276 and CVE-2026-86060
• CISA Known Exploited Vulnerabilities Catalog, RouterOS entries added 10 September 2026
• MikroTik security advisory and fixed RouterOS release notes