MikroTrick: How Two SSH Flaws Let Attackers Take Over MikroTik Routers Without Credentials

The MikroTrick exploit chain demonstrates the dangers of neglecting router security. CERT Polska disclosed two vulnerabilities in MikroTik RouterOS that, when combined, allow unauthenticated attackers to gain full control of internet-facing devices.

The first vulnerability (CVE-2026-67276) is an SSH public-key authentication bypass. It takes advantage of a logic error in how RouterOS verifies RSA public keys. By forging a public key with an exponent of 1, attackers can authenticate without needing the private key. All that is required is knowledge of the victim's public-key modulus and username.

Once authenticated, the second flaw (CVE-2026-86060) raises the attacker's privileges to full administrator. This is achieved through a crafted username that triggers improper handling of argument delimiters. The result is complete control over the device, allowing attackers to intercept traffic, modify routing and firewall rules, and repurpose the device as a proxy or tunnel.

The exploitation began before a patch was available. MikroTik released fixes on September 3, 2026, while CERT Polska recorded attacker activity starting on September 2. This classifies it as a zero-day attack - a threat that was actively exploited before a fix existed.

CISA added the RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalog on September 10, with a remediation deadline of September 13. Indicators of compromise include SSH login attempts using the username -2, unauthorized high-privilege accounts, and devices marked as "Flagged" due to self-checks for known tampering. Reported attack source addresses include 82.192.72.4 and 103.102.31.18.

The Flagged mechanism records signs of known modification after the fact, useful for triage but not a prevention method. MikroTik released fixes across its RouterOS release trains, with the minimum required versions being 6.49.21 for 6.x, 7.23.4 for 7.x long-term, and 7.24.2 for stable releases.

In summary, MikroTrick highlights the risks of insufficient router security, especially when management interfaces are exposed to the internet. Upgrading to fixed RouterOS versions, restricting SSH access, and verifying system integrity are critical steps to mitigate the threat. Devices that were compromised should be isolated, their configurations examined for malicious changes, and unauthorized accounts removed before they are brought back online. This incident underscores the importance of exposure management in protecting networked devices.