Date: September 23, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Network Infrastructure Security / Vulnerability Research / Zero-Day Exploitation
Tags: MikroTik, RouterOS, MikroTrick, CVE-2026-67279, CVE-2026-86060, CERT Polska, Network Security, Edge Exploitation
Executive Summary
On September 22–23, 2026, Poland’s National Computer Emergency Response Team (CERT Polska) released an exhaustive technical post-mortem detailing MikroTrick, a devastating two-stage pre-authentication exploit chain that allows remote threat actors to seize full administrative root control of Internet-exposed MikroTik RouterOS devices. As reported by The Hacker News, the attack chain combines an SSH state-machine vulnerability (CVE-2026-67279) with a command-line argument injection flaw in the RouterOS authentication subsystem (CVE-2026-86060).
Crucially, the MikroTrick chain requires no passwords, no SSH private keys, and no user interaction. Forensic incident response logs revealed that automated threat actors began weaponizing this exploit in the wild as early as September 2, 2026—one day before MikroTik distributed emergency firmware patches in RouterOS versions 6.49.21, 7.23.4, and 7.24.2.
CERT Polska’s disclosure also underscored a sobering evolution in offensive vulnerability research: the extensive role of large language model (LLM) agents in rapid patch diffing. Adversaries and independent researchers reconstructed functional exploit chains within days of binary releases, compressing the defensive window between patch publication and widespread exploitation to near zero.
Technical Deep-Dive: The Anatomy of the MikroTrick Chain
Standard Secure Shell (SSH) protocol negotiation requires a deterministic three-stage handshake:
1. Transport Layer negotiation and key exchange (establishing encrypted channel).
2. User Authentication protocol (verifying username, public key, or password).
3. Connection Protocol and channel allocation (spawning interactive shells or subsystem handlers).
The MikroTrick chain subverts this foundational protocol flow through a sophisticated state-machine desynchronization, as illustrated below:+-----------------------------------------------------------------------------------+
| MIKROTRICK ATTACK CHAIN ARCHITECTURE |
|---|
Unauthenticated Attacker Target MikroTik Router (RouterOS)
| |
| 1. Establish Encrypted SSH Transport |
| [KEXINIT, Diffie-Hellman Key Exchange] |
|------------------------------------------------------->|
| |
| 2. Initiate Partial Auth: |
| `SSH_MSG_USERAUTH_REQUEST` (service: ssh-connection)|
|------------------------------------------------------->|
| | 3. [CVE-2026-67279: State-Machine Flaw]
| 4. Premature Channel Request: | Daemon prematurely allocates
| `SSH_MSG_CHANNEL_OPEN` ("session") | session channels BEFORE receiving
|------------------------------------------------------->| `SSH_MSG_USERAUTH_SUCCESS`!
| |
| 5. Channel Accepted by RouterOS |
| `SSH_MSG_CHANNEL_OPEN_CONFIRMATION` |
|<-------------------------------------------------------|
| |
| 6. Malicious Exec Request: |
| `SSH_MSG_CHANNEL_REQUEST` ("exec") |
| Payload: Argument Injection string |
|------------------------------------------------------->|
| | 7. [CVE-2026-86060: Argument Injection]
| | `login` binary concatenates user
| | parameters into internal shell
| | command line without escaping!
| |
| 8. Arbitrary Root Command Detonation: |
| - Adds rogue admin account |
| - Injects SOCKS5 proxy / Port forward |
| - Installs backdoor script into Flash storage |
|<=======================================================|
1. Stage 1: The SSH State-Machine Bypass (CVE-2026-67279)
Under RFC 4252 (The Secure Shell Authentication Protocol), an SSH server must reject any request to open a channel (SSH_MSG_CHANNEL_OPEN) until client authentication has successfully resolved with an explicit SSH_MSG_USERAUTH_SUCCESS packet.
In vulnerable versions of RouterOS (spanning both legacy v6 and modern v7 releases), the custom SSH server daemon contained an architectural state-machine flaw:
* When a client initiated a user authentication request for ssh-connection but never completed credential submission (leaving the state in partial negotiation), the daemon failed to set a blocking enforcement flag on the channel management subsystem.
* If the client dispatched an immediate SSH_MSG_CHANNEL_OPEN of type session, the state machine treated the active cryptographic transport context as sufficient authorization, granting the client an active channel handle without ever verifying credentials.
2. Stage 2: Login Process Argument Injection (CVE-2026-86060)
Achieving an open channel without credentials left attackers in an unprivileged, restricted environment. To execute arbitrary administrative commands, the attacker chained the state-machine bypass with an argument injection flaw in RouterOS's internal process launcher.
When processing an incoming exec request over the premature session channel:
* The SSH daemon delegated command execution to an internal authentication wrapper (/nova/bin/login).
* The username and command string supplied in the early handshake were passed directly into a formatted shell string using inadequate sanitization:
// Conceptual representation of vulnerable command assembly
snprintf(command_buffer, sizeof(command_buffer), "/nova/bin/console -u '%s' -c '%s'", untrusted_user, untrusted_cmd);
system(command_buffer);
* By injecting single quotes, whitespace delimiters, and shell metacharacters (e.g., ;, &&, or backticks) into the unverified username parameter, the attacker broke out of the parameter bounds, executing arbitrary system binaries with root privileges on the underlying Linux kernel.
3. Exploitation Weaponization in the Wild
CERT Polska’s threat intelligence telemetry observed threat actors actively deploying MikroTrick to execute the following immediate post-exploitation actions:
1. Creation of Covert Administrative Accounts: Executing /user add name=system_mgr group=full password=[REDACTED] to secure out-of-band persistent access.
2. Traffic Redirection and BGP Hijacking: Altering static routing tables and configuring rogue GRE/WireGuard tunnels to mirror enterprise traffic to attacker IP listeners.
3. Proxy Harvesting: Enabling RouterOS's built-in SOCKS proxy service (/ip socks set enabled=yes port=1080) to route malicious bulletproof hosting traffic and automated brute-force attacks through consumer and enterprise edge routers.
The LLM Agent Dimension: Accelerated Vulnerability Reconstruction
A critical revelation in CERT Polska's analysis is the role of modern AI code-analysis agents during the vulnerability lifecycle.
Following MikroTik’s initial release of patch versions 6.49.21, 7.23.4, and 7.24.2 on September 3, 2026, researchers demonstrated that modern automated binary diffing engines coupled with autonomous LLM agents (such as Claude Code and custom AST analyzers) were able to:
* Decompile stripped RouterOS binaries and pinpoint patched basic blocks in libssh wrappers within hours.
* Generate valid protocol packet sequences modeling the desynchronized SSH state machine.
* Synthesize working proof-of-concept (PoC) exploit scripts in less than 72 hours.
This phenomenon highlights a fundamental shift in defensive mathematics: security through obscurity or delayed disclosure is dead. As soon as a firmware update is compiled and distributed, automated AI agents can diff the binaries and produce offensive exploits before system administrators can complete staging and regression testing.
Affected Versions and Remediation Matrix
The MikroTrick vulnerability chain affects all unpatched MikroTik deployments running RouterOS v6 and v7 where the SSH management service is exposed to untrusted networks.
RouterOS Branch
Vulnerable Releases
Patched Release
RouterOS v6 (Long-Term)
Versions prior to 6.49.21
6.49.21 (or later)
RouterOS v7 (Stable)
Versions prior to 7.23.4
7.23.4 (or later)
RouterOS v7 (Testing / Development)
Versions prior to 7.24.2
7.24.2 (or later)
Incident Response & Hardening Playbook
Network administrators managing MikroTik equipment must immediately take the following actions:
1. Upgrade Firmware Immediately
Apply the latest stable RouterOS firmware via WinBox, WebFig, or secure console:/system package update
check-for-updates
install
2. Enforce Strict Service Isolation
Never expose management services to public WAN interfaces. Restrict SSH and WinBox strictly to authorized management IP subnets:# Restrict SSH service to a dedicated jump host or management subnet
/ip service set ssh address=10.100.0.0/24 port=22 disabled=no
Disable unused remote management interfaces
/ip service set telnet disabled=yes
/ip service set ftp disabled=yes
/ip service set api disabled=yes
/ip service set api-ssl disabled=yes
3. Compromise Assessment & Forensic Audit
If your MikroTik router had SSH reachable from the public internet between August 25 and September 23, 2026, assume potential compromise and perform an immediate integrity review:
* Check Administrative Users: Inspect the user database for unfamiliar accounts with full permissions:/user print detail
* Inspect Scheduled Scripts: Check for suspicious automated scripts deployed in the scheduler:/system script print
/system scheduler print
* Review Active SOCKS Proxies and Tunnels: Verify that unauthorized proxies or WireGuard/GRE interfaces were not established:/ip socks print
/interface wireguard print
* Review Firewall Filter and NAT Rules: Audit for rogue port forwarding rules redirecting internal subnet traffic:/ip firewall nat print
/ip firewall filter print
Conclusion
MikroTrick illustrates the persistent vulnerability of enterprise network perimeters. When edge devices running custom network stacks suffer foundational protocol implementation errors, the resulting blast radius compromises the entire internal network. Organizations must treat edge routers not merely as transport hardware, but as tier-zero critical assets requiring aggressive patching, strict firewall isolation, and continuous configuration auditing.
Stay informed on critical infrastructure exploits at Digital Spying.