MikroTrick chain takes over MikroTik routers, no passwo

What Happened

Researchers have disclosed a two-stage attack chain, dubbed MikroTrick, that grants full administrative control of Internet-exposed MikroTik RouterOS devices without a password, SSH key, or any completed authentication. The chain combines two SSH-layer vulnerabilities tracked as CVE-2026-67279 and CVE-2026-86060. Neither bug is individually sufficient to compromise a router, but chained in sequence they carry an unauthenticated attacker from initial connection to root-equivalent control of the device.

The first vulnerability in the sequence breaks the authentication handshake, allowing a crafted SSH session to proceed into privileged code paths that should be unreachable before login. The second escalates that foothold to full administrative access. Because the entire chain operates over SSH, the attack resembles legitimate management traffic and does not require the attacker to know any credential on the target.

Why It Matters

MikroTik RouterOS powers a large installed base of edge routers, ISP access equipment, and branch-office gateways, many of which are managed directly from the public Internet. A device that hands out admin access without a password is not a vulnerable endpoint in the ordinary sense - it is a pre-authenticated backdoor reachable by anyone who can route packets to port 22. Compromise of an edge router typically yields more than the device itself: adjacent network visibility, the ability to redirect or intercept traffic, VPN credential capture, and a persistent staging point inside the perimeter that survives endpoint remediation.

Technical Details

Both flaws live in RouterOS’s SSH implementation, which is why the attack needs no web interface, no Winbox, and no client software beyond a standard SSH stack. The chain is reported to work against Internet-exposed routers with SSH enabled, and it requires no user interaction on the target side. The privilege escalation component, CVE-2026-86060, has already been observed exploited in the wild with public proof-of-concept code circulating, which materially shortens the window before commodity exploitation of the full chain.

Immediate Risk

Severity is critical. Any RouterOS device with SSH reachable from an untrusted network should be treated as potentially compromised, not merely vulnerable. Immediate actions: audit RouterOS versions against vendor guidance, disable or firewall SSH management to trusted addresses only, remove any Internet-facing management plane, and hunt for unauthorized users, added SSH keys, scheduled scripts, and configuration exports on affected devices. Because the chain requires no credential, standard password-rotation and MFA controls provide no protection here.

Security Insight

The notable property of MikroTrick is not the individual bugs but that it defeats authentication as a control entirely. Security programs still tend to treat “no valid credentials” as proof that an intrusion attempt failed, and logging built around failed-login alerts will miss this chain because no authentication is attempted or completed. Defenders should shift detection for edge devices toward configuration-integrity monitoring and outbound session anomalies rather than login telemetry, and treat exposing SSH on a router the way they would treat exposing a database port directly to the Internet: as an architectural defect to be eliminated, not a setting to be tuned.

Further Reading

• RouterOS SSH login privilege escalation, exploited (CVE-2026-86060) [PoC]
• Latest Security News
• CVE Advisories
• Data Breach Reports