Kiran 
Security researchers at Bishop Fox have confirmed that attackers exploited internet-facing MikroTik RouterOS devices using an unauthenticated takeover chain dubbed “MikroTrick,” and they found it happening in the wild before patches were even public.
The story began on September 5, 2026, when CERT Polska disclosed six RouterOS vulnerabilities and warned that some had already been actively exploited.
Bishop Fox’s adversarial operations team, led by researcher Emilio Gallegos, dug into the technical advisory and zeroed in on the path requiring the fewest prerequisites: CVE-2026-67279, an authentication-state bypass that needs no credentials at all.
MikroTrick: Unpatched MikroTik RouterOS Flaw
Their lab reproduction confirmed that this wasn’t a theoretical risk; it was a working exploit chain capable of full administrative takeover on RouterOS 7.x builds.
MikroTrick strings together two separate design failures. The first, CVE-2026-67279, abuses SSH “rekeying,” a normal encryption-renegotiation step, to trick RouterOS into treating an unauthenticated connection as if it had already passed login, letting an attacker open a terminal session with no credentials.
That alone doesn’t grant admin rights. The second flaw, CVE-2026-86060, does the real damage. RouterOS passes the client’s SSH username directly to a login-helper program, which contains a legacy feature: a username starting with a dash is instead read as a file-descriptor number pointing to a “trusted” identity record.
By supplying the username “-2,” attackers redirect the helper to read identity data straight from their own terminal session, effectively handing themselves administrator status without ever authenticating.
MikroTik’s fixes, shipped in 6.49.21, 7.23.4, and 7.24.2, close both gaps: the SSH dispatcher now confirms a session has an assigned policy before proceeding, and a new input validator rejects dash-prefixed usernames before they reach the helper.
But patching doesn’t undo prior compromise. During authorized testing, Bishop Fox found real routers bearing the fingerprints of this campaign: a script named “logrotate” and a scheduler called “daily-maint” that silently recreated a full-privilege account every 24 hours if removed.
Notably, these malicious objects displayed owner=”0,” a numeric identity distinct from named admin accounts, giving defenders a concrete hunting signal, though not definitive proof of compromise on its own.
Mitigation
Security teams running MikroTik infrastructure should treat this as an active incident-response scenario, not a routine patch cycle:
- Upgrade immediately to RouterOS 6.49.21, 7.23.4, 7.24.2, or later.
- Audit privileged accounts, scripts, schedulers, and configuration history for objects owned by “0.”
- Check the RouterOS flagged state and remote logs, since local logs are volatile and often erased on reboot.
- If compromise is suspected, preserve configuration and logs before any reset, then rebuild from a verified baseline and rotate all stored credentials.
MikroTik reminds us that router security bugs rarely stay theoretical for long, and that patch status and compromise status are two different questions requiring two different investigations.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
