Date: September 26, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Network Security / Edge Infrastructure / Botnets & Threat Intelligence
Tags: MikroTik, RouterOS, MikroTrick, CVE-2026-67279, CVE-2026-86060, CISA KEV, SSH Bypass, Botnets
Executive Summary
Edge network routing infrastructure is under siege from automated mass-exploitation campaigns. On September 25–26, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-67279 and companion vulnerability CVE-2026-86060 to its Known Exploited Vulnerabilities (KEV) catalog. As documented in technical advisories from CERT Polska, The Hacker News, and Aviatrix, the flaws form a devastating pre-authentication exploit chain dubbed MikroTrick, allowing unauthenticated remote threat actors to achieve complete root compromise of MikroTik RouterOS devices.
The exploit chain impacts RouterOS version 7.x builds prior to 7.24.2, combining an SSH state-machine authentication enforcement failure with a system command argument-injection vulnerability. Threat actors require zero credentials and zero user interaction to execute native operating system commands, hijack router routing tables, and install persistent backdoors.
With millions of MikroTik devices serving as core gateways for internet service providers (ISPs), critical infrastructure networks, and corporate branch offices worldwide, state-sponsored cyber espionage units and botnet operators are racing to weaponize the vulnerability for residential proxy harvesting, traffic interception, and internal corporate lateral movement.
Technical Deep-Dive: Deconstructing the MikroTrick Exploit Chain
To understand why the MikroTrick chain is so lethal to perimeter defense, we examine how RouterOS handles SSH connection states and internal CLI command dispatching.+-----------------------------------------------------------------------------------+
| MIKROTRICK EXPLOIT ATTACK CHAIN |
|---|
Remote Unauthenticated Attacker MikroTik RouterOS Edge Gateway (Linux Kernel)
| |
| 1. Initiates standard SSH handshake |
| `SSH-2.0-OpenSSH_9.x` to TCP port 22 |
|-------------------------------------------------------------->|
| 2. Key exchange & cipher negotiation completes |
|<--------------------------------------------------------------|
| |
| 3. [CVE-2026-67279: STATE-MACHINE BYPASS] |
| Attacker skips `SSH_MSG_USERAUTH_REQUEST` entirely! |
| Directly transmits `SSH_MSG_CHANNEL_OPEN` (session) |
| and `SSH_MSG_CHANNEL_REQUEST` (exec) |
|-------------------------------------------------------------->|
| |
| | 4. RouterOS SSH Daemon flaw:
| | - Fails to assert authenticated state!
| | - Spawns unauthenticated session channel!
| |
| 5. [CVE-2026-86060: ARGUMENT INJECTION] |
| Transmits crafted CLI exec payload with shell metacharacters|
| `exec /system script add source="...; /bin/sh"` |
|-------------------------------------------------------------->|
| |
| | 6. Command Dispatcher evaluates:
| | - Escapes restricted CLI sandbox!
| | - Executes arbitrary bash/sh as root!
| |
| 7. Root Shell Established! |
|<==============================================================|
v v
Full Router Takeover -> SOCKS5 Proxy Deployed, DNS Poisoned, Internal LAN Accessible!
1. Step 1: The SSH State-Machine Failure (CVE-2026-67279)
In a RFC 4252 compliant SSH server, an incoming client connection must successfully negotiate authentication via SSH_MSG_USERAUTH_REQUEST (using password, public key, or GSSAPI) before any session channels (SSH_MSG_CHANNEL_OPEN) can be established.
* MikroTik implemented a customized lightweight SSH daemon within RouterOS to minimize resource overhead on embedded MIPS, ARM, and x86 hardware.
* CERT Polska’s vulnerability research team discovered that RouterOS’s SSH state machine fails to strictly enforce sequential state validation:
* If a remote client skips authentication messages and immediately dispatches a channel open request followed by a channel exec request, the daemon fails to reject the packet, prematurely transitioning the connection into an authorized execution state.
2. Step 2: Breaking the Restricted Shell via Argument Injection (CVE-2026-86060)
Under normal conditions, even an authenticated low-privilege user in RouterOS is restricted to an interactive CLI menu that isolates users from the underlying Linux operating system.
* However, when commands are passed via SSH exec channels, RouterOS translates the text string into internal CLI command structures.
* The argument-parsing routine fails to sanitize semicolon (;), backtick, and quotation characters.
* By injecting shell control operators into parameters passed to /system script or diagnostic commands, the attacker breaks out of the RouterOS CLI environment and executes commands directly in the root Linux shell (/bin/sh).
3. Achieving Covert Persistence & Botnet Enlistment
Once root access is attained, adversaries deploy post-exploitation modules:
* Rogue User Account Creation: The exploit adds stealth administrator users hidden from common configuration views.
* SOCKS5 Proxy Deployment: Attackers spin up covert SOCKS5 proxy listeners (often on high ephemeral ports), turning the compromised edge router into an anonymous relay node for cyber espionage campaigns or cybercriminal proxy services.
* DNS Redirection & Man-in-the-Middle: By altering RouterOS DNS cache settings (/ip dns set servers=...), attackers redirect corporate employee web traffic to malicious phishing portals.
Edge Threat Landscape: Echoes of the Meris Botnet
The mass exploitation of edge routers carries profound systemic implications:
* The Ghost of Meris: In 2021, the Meris botnet compromised over 250,000 MikroTik devices using unpatched vulnerabilities, unleashing record-breaking DDoS attacks exceeding 21.8 million requests per second. MikroTrick provides threat actors with an even simpler, pre-auth path to achieve identical botnet recruitment.
* Stealthy Ingress into Enterprise LANs: Because routers sit directly on perimeter boundaries, a compromised router allows attackers to bypass corporate firewalls and inspect internal traffic flowing between branch offices and data centers.
* CISA Federal Mandate: CISA’s addition of CVE-2026-67279 and CVE-2026-86060 to the KEV catalog mandates that all Federal Civilian Executive Branch agencies patch or disconnect vulnerable MikroTik equipment immediately.
Defensive Hardening & Mitigation Blueprint
Network administrators, internet service providers, and enterprise security engineers must execute immediate containment and hardening measures:
1. Upgrade RouterOS Immediately (Primary Fix)
Deploy the official vendor patches released by MikroTik:
* Upgrade RouterOS to version 7.24.2 or later.
* For organizations maintaining long-term support branches, upgrade to patched LTS release 7.15.x.
Check and upgrade RouterOS via CLI
/system package update check-for-updates
/system package update install
2. Restrict External Management Ingress (Zero-Trust Principle)
Never expose RouterOS management interfaces to the public internet:
* Restrict SSH (TCP 22) and WinBox (TCP 8291) exclusively to internal management subnets or dedicated VPN interfaces:
Restrict SSH access to trusted internal IP subnets
/ip service set ssh address=10.0.0.0/8,192.168.1.0/24
/ip service set winbox address=10.0.0.0/8,192.168.1.0/24
* If remote administration is required, mandate that administrators connect through an encrypted WireGuard or IPsec VPN tunnel prior to accessing router management ports.
3. Audit Device Integrity & Threat Hunting Playbook
Execute an immediate forensic inspection across your router fleet to identify potential indicators of compromise (IoCs):
* Audit User Accounts: Inspect the user database for unfamiliar accounts:/user print
* Audit Scheduled Scripts & Tasks: Threat actors frequently establish persistence via scheduled scripts:/system script print
/system scheduler print
* Inspect Firewall NAT Rules: Check for unexpected port-forwarding rules redirecting internal traffic externally:/ip firewall nat print
/ip socks print
________________
For technical threat intelligence advisories, network perimeter vulnerability teardowns, and edge infrastructure defense research, follow Digital Spying.