---
title: "MikroTrick: Exploited MikroTik RouterOS SSH Takeover Chain"
url: https://erroneo.us/security/briefs/mikrotik-routeros-mikrotrick-ssh-cve-2026-86060/
description: "Unauthenticated SSH flaws give full admin on RouterOS 6 and 7, exploited before patches. Upgrade to 7.24.3, 7.23.6 or 6.49.21 and hunt for an 'ops' user."
type: security-brief
section: "Security Digest"
date_published: 2026-09-03
date_modified: 2026-10-06
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-86060", "CVE-2026-67279", "CVE-2026-67277"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# MikroTrick: Exploited MikroTik RouterOS SSH Takeover Chain

**Verdict: Act now.** If you run MikroTik routers, upgrade them now and check for an 'ops' admin account; an unauthenticated SSH chain to full admin was exploited a day before patches shipped.

- **Who must act:** Anyone running RouterOS 6 or 7, most urgently where SSH, WebFig or the bandwidth-test server is reachable from the internet or another untrusted network.
- **Who can relax:** Teams with no MikroTik gear; devices whose management services are reachable only over a management VPN still need the upgrade but are not on the reported attack path.
- **Affected:** RouterOS 7.24 before 7.24.2; RouterOS 7.0 through 7.23.x before 7.23.4; RouterOS 6.x before 6.49.21; RouterOS 7.24.2 and 7.23.4 (incomplete fix for companion bug CVE-2026-67278)
- **Fixed:** RouterOS 7.24.3 (stable) or later; RouterOS 7.23.6 (long-term) or later; RouterOS 6.49.21 (long-term) or later
- **CVEs:** CVE-2026-86060, CVE-2026-67279, CVE-2026-67277
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every RouterOS device, including cloud and lab instances, and record its version.
2. Upgrade to 7.24.3, 7.23.6 or 6.49.21 or later; devices moved to 7.24.2 or 7.23.4 in September need a second upgrade.
3. Restrict SSH, WebFig (www/www-ssl) and the bandwidth-test server to trusted management addresses or disable them; prefer a VPN for management.
4. Run /system/device-mode/print and check the log for a critical 'Flagged' entry after upgrading.
5. Review users, scripts, scheduler entries, proxies and tunnels for anything you did not create, starting with a full-privilege user named 'ops'.
6. If you find signs of compromise, preserve logs and config, factory reset, rebuild from a trusted configuration and rotate every secret on the device.

### How to check if you are affected

- Search RouterOS logs for 'login failure for user -2' and 'added by ssh:-2@' entries.
- Look for a full-privilege user named 'ops', and for scheduled scripts that recreate a privileged account.
- Check for SSH connections from 82.192.72.4 (successful attacks) and 103.102.31.18 (attempts), per CERT Polska.
- On fixed releases, check whether /system/device-mode/print reports the device as flagged.

## What happened

On September 3, 2026, MikroTik shipped RouterOS 7.24.2, 7.23.4 and 6.49.21 as "an important security update" and held back the details. The [release notes](https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800) mentioned only an SSH refactor and btest stability fixes. Two days later CERT Polska [published the findings](https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/): six RouterOS bugs, two of which chain into what it calls **MikroTrick**. The chain gives full administrative control "without authentication" when SSH is reachable. CERT Polska says successful attacks began no later than September 2, a day before the patches.

Three of the six CVEs are in CISA's KEV catalog:

- [CVE-2026-67279](https://www.cve.org/CVERecord?id=CVE-2026-67279) (CVSS 4.0 6.9): after a client-requested rekey, RouterOS SSH enters the connection protocol even though no login was attempted. The client can then open a session channel and send an exec request. Added to KEV September 25.
- [CVE-2026-86060](https://www.cve.org/CVERecord?id=CVE-2026-86060) (CVSS 4.0 9.2): the SSH login helper accepts a username starting with a prohibited character. [Bishop Fox](https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain) explains that the username `-2` makes the helper read its trusted identity from file descriptor 2, which the attacker controls. The helper then accepts a forged administrator record. Added to KEV September 10.
- [CVE-2026-67277](https://www.cve.org/CVERecord?id=CVE-2026-67277) (CVSS 4.0 8.8): the bandwidth-test (btest) service accepts a related connection before authentication. That leaks uninitialized kernel memory and can restart the router. Added to KEV September 10.

The other three, which are not in KEV, are an SSH public-key check that skips the RSA exponent (CVE-2026-67276), an unauthenticated WebFig file read on 7.20 and newer (CVE-2026-67281), and RSA signature forgery against TLS and SSH host keys (CVE-2026-67278). The September builds only partly fixed CVE-2026-67278. MikroTik's [updated advisory](https://mikrotik.com/supportsec/september-2026-vulnerability) names 7.24.3 and 7.23.6 as the complete fix.

## Who is affected

The KEV-listed bugs affect RouterOS 6.x before 6.49.21, 7.0 through 7.23.x before 7.23.4, and 7.24 before 7.24.2, according to [CERT Polska's CVE list](https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve). Bishop Fox reproduced the full takeover on 7.x. On 6.49.20 the rekey bypass worked, but the chain did not produce an admin session. Patch 6.x anyway. CERT Polska's recommended minimums are 7.24.3 (stable), 7.23.6 (long-term) and 6.49.21.

## Do you really need to act?

If you own RouterOS devices, yes. The precondition is a reachable SSH service. MikroTik says its default configurations block management services from the internet, so the main targets are routers where someone opened SSH. That happens often on ISP, branch-office and hosted routers. The attack needs no credentials, CISA rates it automatable, and it worked before any patch existed. [The Hacker News](https://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html) notes that no authoritative count of compromised devices has been published. Bishop Fox found compromise artifacts on internet-facing routers during authorized testing.

A router whose SSH is reachable only over a management VPN is not on the reported attack path. It still runs the vulnerable code, so upgrade it this week. The incomplete CVE-2026-67278 fix means devices upgraded in September need a second upgrade.

## What to do now

1. On each device, check the version with `/system resource print`.
2. Upgrade with `/system package update check-for-updates` then `/system package update install`, to 7.24.3, 7.23.6 or 6.49.21 or later.
3. Limit management services to trusted addresses, for example `/ip service set ssh address=192.0.2.0/24`, and do the same for `www`/`www-ssl`. Turn off the bandwidth-test server with `/tool bandwidth-server set enabled=no` if you do not use it. CERT Polska also advises against using `/system ssh` outbound from unpatched devices.
4. After upgrading, run `/system/device-mode/print`. Fixed releases scan for known traces of tampering at boot and set a "Flagged" marker. Do not clear it until you have investigated.
5. Review `/user print`, `/system script print` and `/system scheduler print` for anything you did not create.

## How to tell if you were hit

CERT Polska lists log lines such as `login failure for user -2 from <ip> via ssh` followed by `user <name> added by ssh:-2@<ip>`, a full-privilege user named `ops`, successful attacks from `82.192.72.4` and attempts from `103.102.31.18`. Bishop Fox found a scheduled script that recreated a privileged account every day. It suggests objects with `owner="0"` as a hunting lead, with the caveat that legitimate objects can also show this. A missing indicator does not rule out compromise. If you find one, isolate the device, secure the logs and configuration, factory reset, and rebuild from a trusted configuration rather than a backup taken from the device. Then rotate every password, key and secret it held. Upgrading blocks new exploitation but does not remove existing access.

## Timeline

- Sep 2, 2026 — Earliest successful attacks seen by CERT Polska.
- Sep 3, 2026 — MikroTik releases 7.24.2, 7.23.4 and 6.49.21 with no vulnerability details.
- Sep 5, 2026 — CERT Polska publishes the six CVEs, the MikroTrick chain and indicators.
- Sep 10, 2026 — CISA adds CVE-2026-86060 and CVE-2026-67277 to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060).
- Sep 17, 2026 — Bishop Fox publishes its analysis of the chain.
- Sep 25, 2026 — CISA adds CVE-2026-67279 to KEV ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-67279)).
- Oct 6, 2026 — MikroTik updates its advisory to list all six CVEs and names 7.24.3 and 7.23.6 as the complete fix.

## Sources

1. [MikroTik — RouterOS September 2026 vulnerability advisory](https://mikrotik.com/supportsec/september-2026-vulnerability)
2. [CERT Polska — Vulnerabilities in MikroTik RouterOS actively exploited](https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/)
3. [CERT Polska — MikroTik RouterOS CVE entries](https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve)
4. [CVE record — CVE-2026-86060](https://www.cve.org/CVERecord?id=CVE-2026-86060)
5. [CVE record — CVE-2026-67279](https://www.cve.org/CVERecord?id=CVE-2026-67279)
6. [CVE record — CVE-2026-67277](https://www.cve.org/CVERecord?id=CVE-2026-67277)
7. [NVD — CVE-2026-67279](https://nvd.nist.gov/vuln/detail/CVE-2026-67279)
8. [CISA — Known Exploited Vulnerabilities: CVE-2026-86060](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060)
9. [MikroTik forum — RouterOS 7.24.2 stable release notes](https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800)
10. [Bishop Fox — MikroTrick: inside the RouterOS takeover chain](https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain)
11. [The Hacker News — MikroTrick chain let attackers take over RouterOS](https://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html)

---
Source page: https://erroneo.us/security/briefs/mikrotik-routeros-mikrotrick-ssh-cve-2026-86060/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt