MikroTik RouterOS Flaw Chain Enables Passwordless Administrative Access to Exposed Routers

Summary

CERT Polska explains how CVE-2026-67279 and CVE-2026-86060 can be chained to take over Internet-exposed MikroTik routers. Logs indicate exploitation before patches; administrators should update and check for compromise.

Key points

The MikroTrick chain combines an SSH state-machine flaw, CVE-2026-67279, with a login argument-injection flaw, CVE-2026-86060.
Attackers can use the username -2 to reach a fully privileged RouterOS console without completing authentication.
CERT Polska says matching logs appeared by September 2, before patches were released on September 3 in RouterOS 6.49.21, 7.23.4, and 7.24.2.
Some affected-device reports showed creation of an ops account; other activity strongly suggested configuration data was transferred to attacker infrastructure.
CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10. No authoritative count of compromised devices has been published.
Administrators should patch, inspect logs and devices for suspicious accounts and other changes, and isolate, preserve evidence, factory reset, and rebuild devices if compromise is suspected.
CERT Polska recommends changing credentials and not restoring backups from compromised devices. The Flagged status check can detect selected traces, but its absence does not prove a device is safe.

Article Details

Attack Vectors: Attackers chained CVE-2026-67279 and CVE-2026-86060 over SSH to gain full administrative control of Internet-exposed MikroTik RouterOS devices without completing authentication.
The attack used the username -2 to trigger argument injection in the RouterOS login process.
Defensive Notes: Patch RouterOS to a fixed release: 6.49.21, 7.23.4, or 7.24.2.
Review SSH logs for failed login attempts using username -2, and check for the ops account with full privileges, unknown users, scripts, scheduler entries, tunnels, proxies, unexpected .rif diagnostic files, and unexplained fetch activity.
Check device status with /system/device-mode/print, but do not treat the absence of a Flagged status as proof that the device is safe.
If compromise is suspected, isolate the device, preserve logs and configuration, factory reset it, and rebuild it from a trusted configuration. Change passwords, keys, and other credentials, and do not restore a backup from a compromised device.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]102[.]31[.]18`	IP address used in exploitation attempts, according to CERT Polska.
IPV4	`82[.]192[.]72[.]4`	IP address observed in successful attacks, according to CERT Polska.