MikroTik has patched a critical pair of vulnerabilities in RouterOS, designated as the “MikroTrick” exploit chain, allowing remote unauthenticated adversaries to gain administrative control over edge routers. Disclosed by CERT Polska, the attack links an SSH authentication bypass (CVE-2026-67276, CVSS 9.2) with an SSH privilege escalation flaw (CVE-2026-86060, CVSS 9.2). Flawed RSA public-key verification in the RouterOS SSH daemon accepts forged requests when an attacker supplies a known username and the public modulus of an authorized key without possessing the private key. Attackers then exploit argument handling during login, supplying crafted username strings such as -2 to rewrite the session policy mask and gain administrative rights (ssh:-2@<ip>).

Active exploitation targeted exposed SSH services prior to vendor patching, with over 122,000 devices exposed and prompting CISA Known Exploited Vulnerabilities catalog inclusion. Threat actors leveraged hijacked routers to stage rogue administrative accounts, route malicious traffic through SOCKS proxies, and pivot into private subnets. MikroTik resolved the vulnerabilities in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, introducing a post-update mechanism that flags and isolates unauthorized startup modifications.

Why it matters:

• Boundary defense subversion: Chaining pre-authentication cryptographic verification bypass with session policy manipulation neutralizes edge perimeter isolation, enabling unauthenticated remote attackers to turn routing infrastructure into covert, persistent footholds for deep internal pivoting.
• Immediate management plane lockdown: Network operators must immediately apply RouterOS patches, inspect logs for suspicious account generation (ssh:-2@), and isolate administrative services (SSH, Winbox, WebFig) behind dedicated management VLANs or VPNs rather than exposing them to untrusted ingress.