MikroTrick SSH Exploit Chain Gives Attackers Administrative Control of MikroTik Routers

Attackers have exploited the MikroTrick vulnerability chain against MikroTik RouterOS devices since at least September 2, 2026, according to CERT Polska. The chain combines two critical flaws, each rated CVSS v4.0 9.2, to bypass SSH authentication and gain full administrative control through exposed SSH services. CVE-2026-67276 affects RouterOS 7.x: authorized RSA key matching ignores the exponent, allowing an attacker who knows an authorized key’s modulus to supply an exponent of one and forge authentication without the private key. CVE-2026-86060 mishandles specially formed SSH usernames, allowing an unauthenticated session reaching the login helper to modify the trusted policy mask and escalate privileges. Observed attackers created a privileged local account named ops.

MikroTik fixed both flaws in RouterOS 7.23.4 Long-term and 7.24.2 Stable; 6.49.21 Long-term also fixes CVE-2026-86060. Administrators should prioritize upgrades, restrict SSH access from untrusted networks, and inspect accounts and configuration changes for compromise; patching alone does not remove attacker-created accounts. Public exploit code and patch analysis increase the risk of broader exploitation. Both flaws appear in the EU Known Exploited Vulnerabilities list, while CISA lists CVE-2026-86060 but not CVE-2026-67276 despite the reported exploitation. CISA also lists the separate RouterOS bandwidth-test vulnerability CVE-2026-67277.