MikroTrick: The SSH Chain That Empties RouterOS Before Login…

The MikroTrick attack chain targets MikroTik RouterOS from at least September 2, 2026, allowing a remote attacker to gain full administrative control without a password, SSH key, or completed authentication. Active exploitation began one day before MikroTik released patches on September 3, 2026, making the flaw a zero-day in the initial window. The mechanism violates the SSH state model itself: a protocol considered secure by definition becomes a vector for total takeover.

{"main_topic":"vulnerability","topics":["vulnerability","cybersecurity","router","zero-day","exploit","cve"]}

The MikroTrick attack chain targeted MikroTik RouterOS from at least September 2, 2026, allowing a remote attacker to gain full administrative control without a password, SSH key, or completed authentication. Active exploitation began one day before MikroTik released patches on September 3, 2026, making the flaw a zero-day in the initial window. The mechanism violates the SSH state model itself: a protocol considered secure by definition becomes a vector for total takeover.

Key Takeaways

The MikroTrick chain combines CVE-2026-67279 (SSH authentication state bypass via rekeying) with CVE-2026-86060 (argument injection in the login helper), both pre-authentication
CERT Polska documented in-the-wild exploitation from at least September 2, 2026, with indicators of compromise including the 'ops' account, IPs 82.192.72.4 and 103.102.31.18, the 'logrotate' script, and the 'daily-maint' scheduler
Bishop Fox independently reproduced full takeover on RouterOS 7.x; on 6.x the first stage works but full escalation does not
Shadowserver Foundation detected over 122,500 MikroTik devices with SSH exposed on the internet in a 24-hour window on September 5, 2026

How SSH Breaks: The Three-State Mechanism

The core of the MikroTrick chain lies in a violation of the SSH protocol state machine implemented in RouterOS. The server improperly transitions from "authentication in progress" to "command session" when an unauthenticated client requests rekeying: this is CVE-2026-67279. The server sends SSH_MSG_NEWKEYS without ever receiving SSH_MSG_USERAUTH_SUCCESS, opening a command channel in a state that should not exist.

From this intermediate state — unauthenticated but with an operational channel — CVE-2026-86060 converts access into a privileged shell. The attacker sends "-2" as the username: the /nova/bin/login program interprets this value as an option to read identity and privileges from file descriptor 2, where the attacker has already written forged administrative credentials. According to CERT Polska, cited by The Hacker News: "The MikroTrick chain is CVE-2026-67279 combined with CVE-2026-86060. Some publications have incorrectly included a third flaw, CVE-2026-67276, which CERT Polska says is a separate SSH vulnerability."

The result is a complete bypass of the SSH authentication-authorization-accounting triad: no password to crack, no key to steal, no brute-force required.

Active Exploitation: September 2, One Day Before the Patch

The timeline is critical. MikroTik patches arrived on September 3, 2026, in versions 6.49.21, 7.23.4, 7.24.2, and 7.25beta3. However, attack logs date back to September 2, as documented by CERT Polska. Costin Raiu, cited by SecurityAffairs and reported by HackerNoob, explicitly characterized the phenomenon as a zero-day: "MikroTik has released fixes... on September 3, however, it would appear that exploitation began as early as September 2, making it a 0day."

In-the-wild activity left recurring traces: the 'ops' account with full privileges, IPs 82.192.72.4 and 103.102.31.18, diagnostic .rif files, a script named 'logrotate', and a 'daily-maint' scheduler that recreates the privileged account daily. Bishop Fox, reported by Cyber Security News, verified that "The first-stage bypass also affects 6.x, but Bishop Fox did not achieve an administrative session there with the same method. The tested full takeover applies to vulnerable RouterOS 7.x builds."

CISA added CVE-2026-86060 to the Known Exploited Vulnerabilities catalog on September 10, 2026, confirming the existence of publicly documented exploitation.

"Shadowserver found more than 122,500 MikroTik devices with SSH reachable on the open internet" — Shadowserver Foundation, detection from September 5, 2026

The Exposed Perimeter: 122,500+ Devices, No Filter Is Sufficient

The attack surface is quantifiable. Shadowserver Foundation detected over 122,500 MikroTik devices with SSH exposed on the internet in a 24-hour window on September 5, 2026. These routers populate small businesses, regional ISPs, home labs, and critical infrastructure — contexts where security perception often stops at "strong password on SSH."

The MikroTrick chain voids this premise. The bypass is completely pre-authentication: neither complex passwords nor SSH keys nor MFA protect against the mechanism, because authentication is simply bypassed. The vulnerability resides in the protocol implementation, not in user configuration.

MikroTik sent a push notification to mobile app users for the first time to urge updating, a signal of the severity perceived by the vendor itself. However, patch availability does not equal device cleanup: the observed persistence mechanisms — recurring scripts and schedulers with disguised names — survive the update if not actively removed.

Masked Persistence and the Limits of the 'Flagged' Mechanism

Researchers have documented persistence techniques that challenge superficial forensics. The 'logrotate' script and 'daily-maint' scheduler recreate the privileged account at regular intervals, with naming that mimics legitimate maintenance operations. File ownership is masked to appear as system.

RouterOS includes a 'Flagged' mechanism that marks selected traces of compromise. However, its absence does not guarantee safety: the mechanism is explicitly incomplete for detecting variants of the documented persistence. CERT Polska and Malwarebytes agree in documenting this limit. Anyone who updates without verifying prior compromise status risks keeping the attacker's access active on theoretically patched firmware.

The dossier contains no indication of the exact number of devices actually compromised versus those exposed, nor the identity of the threat actor behind the 'ops' campaign.

What to Do Now

Priority actions derive directly from primary sources:

Verify the presence of patched versions: 6.49.21, 7.23.4, 7.24.2 or later, depending on the branch in use
Check for unauthorized accounts, particularly 'ops', and scripts or schedulers with suspicious names like 'logrotate' or 'daily-maint'
Examine logs for connections from IPs 82.192.72.4 and 103.102.31.18, documented as indicators of compromise
Assess the need for a clean device rebuild rather than a simple update, given the documented sophisticated persistence

Why SSH Is No Longer Enough as a Perimeter

The lesson of the MikroTrick chain transcends the specific case. SSH was designed as a trust protocol: robust authentication, encrypted transport, guaranteed integrity. Its implementation in RouterOS violated the fundamental contract by allowing illegal state transitions. The result is that an inexpensive edge device, often updated late or never updated, becomes an unfiltered bridge to internal networks.

The perception error — that SSH is "secure by definition" — enabled the massive exposure of 122,500+ devices on the internet. Zero-day exploitation leveraged this exposure before the vendor could even react. Post-patch persistence transforms the problem from a temporary incident to a structural compromise.

Anyone managing infrastructure with RouterOS must now assume that SSH exposure on the internet is an intrinsic risk condition, regardless of credential robustness. The protocol is only as secure as its implementation.

Information has been verified against cited sources and updated at the time of publication.

Sources

Sources and references

Get DeafLetter