MikroTrick Chain Enables Unauthenticated Takeover of MikroTik RouterOS Devices

Active exploitation of the MikroTrick vulnerability chain is allowing attackers to take over internet-exposed MikroTik RouterOS devices without credentials. The attack combines an SSH rekeying authentication-state bypass—reported as CVE-2026-67279 (though one advisory lists CVE-2026-67277)—with CVE-2026-86060, in which a crafted username can make the RouterOS login helper accept an attacker-controlled privileged identity. Researchers reproduced full administrative compromise on vulnerable RouterOS 7.x systems, enabling access-control bypass, persistence, and potential lateral movement into connected networks; CISA has added the flaws to its Known Exploited Vulnerabilities catalog.

MikroTik has issued fixes in RouterOS 6.49.21, 7.23.4, 7.24.2, and subsequent applicable releases. Organizations should immediately patch exposed routers, restrict external exposure of Winbox and API services, and audit administrator accounts. They should also investigate devices for attacker-created privileged accounts, scripts, and scheduled tasks, because patching alone will not remove persistence or rotate credentials that may have been exposed during compromise.