MikroTrick SSH flaw chain let attackers take over MikroTik routers with no credentials

Two chained vulnerabilities in MikroTik's RouterOS, nicknamed MikroTrick, let unauthenticated attackers take complete administrative control of routers by abusing the SSH service — and exploitation began before any patch was available. According to a dev.to write-up of the CERT Polska advisory, attacker activity was recorded from 2 September 2026, one day ahead of MikroTik's fixed releases on 3 September.

How the chain works

The first flaw, CVE-2026-67276, is a logic error in RouterOS SSH public-key authentication. The write-up explains that when matching a client's RSA key, the implementation compares the key type and modulus but never checks the RSA exponent, and that signature verification then trusts parameters supplied by the client. An attacker can therefore present a forged key with an exponent of 1, which makes the RSA verification arithmetic collapse — whatever value goes in comes back out unchanged — so the signature always checks out. No private key is needed; knowing the victim's public modulus and username is enough to log in.

Two preconditions apply: the target account must have public-key authentication configured, and the SSH service must be reachable over the network. Both conditions are common on internet-facing MikroTik devices.

The second flaw, CVE-2026-86060, then raises the session to full administrator. CERT Polska classifies it as improper neutralization of argument delimiters, triggered through a crafted username. With both bugs chained, an outsider gains complete control of the device — able to intercept traffic, rewrite firewall and routing rules, or repurpose the router as a proxy or tunnel. The vulnerabilities are rated critical, with reported CVSS scores ranging from about 9.2 to 9.8 depending on the source.

Exploitation outpaced the patch

Because attacks were observed on 2 September while fixes only shipped on 3 September, this qualifies as a zero-day incident in the strict sense: intrusions were running before defenders had anything to install. CISA added the RouterOS flaws to its Known Exploited Vulnerabilities catalog on 10 September, with a federal remediation deadline of 13 September.

Indicators of compromise

The indicators published alongside the advisory are specific enough to check directly. Administrators should look for SSH login attempts using the invalid username -2, which appear in logs as ssh:-2@; unauthorized high-privilege accounts, particularly one named ops; and devices reporting a Flagged state, a boot-time self-check MikroTik added in the patched firmware to detect known tampering. Two source addresses, 82.192.72.4 and 103.102.31.18, were also reported.

The Flagged mechanism deserves a caveat: it records that a device shows signs of modification, which helps during triage, but it does not prevent compromise and only functions after the firmware has been upgraded.

Patches and mitigations

MikroTik shipped fixes across its release trains: RouterOS 6.x long-term at 6.49.21 or later, RouterOS 7.x long-term at 7.23.4 or later, and RouterOS 7.x stable at 7.24.2 or later, plus an additional 7.23.5 build issued on 4 September. Where upgrading immediately is not possible, the interim guidance is to restrict SSH access to trusted management addresses and to disable or limit the bandwidth-test service — measures that shrink reachability without repairing the broken authentication logic.

CERT Polska's guidance is explicit that devices reachable from the internet while unpatched should be treated as potentially compromised, not simply vulnerable. For confirmed intrusions, the recommended sequence is to isolate the device, review configuration changes for malicious entries, and remove unauthorized accounts before returning it to service. Resetting to factory defaults first destroys the evidence needed to understand what the attacker actually did.

Why it matters

MikroTrick breaks an assumption many operations teams rely on: that SSH key authentication is stronger than passwords because it requires holding a private key. Here the attacker authenticates without ever possessing that key, lowering the bar to a public modulus and a username.

It also demonstrates why exposure management can matter more than patch speed. MikroTik hardware is widespread among small and medium businesses, ISPs and branch offices — environments characterized by long device lifetimes, infrequent maintenance and management interfaces left open for remote administration. Since the attacks started before the fix existed, even a well-run patching process could not have closed the window; only restricting management access could have. And because a router sits at the network's trust boundary, compromising one device extends the damage to everything that passes through it.