Summary
- CVE-2026-67279 and CVE-2026-86060 can be chained to obtain full RouterOS administrative access without a password or SSH key.
- MikroTik released fixed RouterOS versions on 3 September, while public logs led CERT Polska to assess that exploitation occurred before the patches.
- The case shows how patch analysis and emerging exploitation evidence can compress coordinated vulnerability-disclosure timelines.
CERT Polska has published a technical analysis of a two-vulnerability MikroTik RouterOS chain that can give a remote attacker full administrative-console access without a password, SSH key, or completed authentication.
The chain, which the Polish national cyber team calls MikroTrick, combines CVE-2026-67279 with CVE-2026-86060. MikroTik released fixed RouterOS versions on 3 September and advised customers to update, initially withholding vulnerability details to give administrators time to install the patches.
CERT Polska says its researchers were already working with MikroTik through coordinated vulnerability disclosure when the vendor’s releases and reports from administrators changed the situation. Public logs appeared to show suspicious SSH activity, including a failed authentication event associated with subsequent privileged access.
Patch analysis then led the researchers to identify CVE-2026-86060 within an hour, according to CERT Polska’s account.
CVE-2026-67279 concerns RouterOS’s SSH implementation. A rekey operation initiated while user authentication was still in progress could cause a vulnerable SSH server to move into channel handling rather than resume authentication.
That issue alone did not assign an authenticated identity or administrative privileges. It did, however, create the state needed to exploit CVE-2026-86060.
The second vulnerability concerned the way a username value was passed into RouterOS’s login process. By manipulating that value, an attacker could cause the application to interpret attacker-controlled data as an effective policy mask.
Combining the two vulnerabilities provided full unauthenticated access to the administrative console, CERT Polska said.
The operational consequence is significant because network infrastructure sits at a privileged point between internal systems and external connectivity. Administrative control of a router can affect traffic visibility, routing, filtering, persistence, and assumptions about network segmentation.
The exposure is particularly acute where SSH administration is reachable from the public internet. The vulnerabilities do not mean every MikroTik device was exploitable under every configuration, and organisations that installed fixed versions were not exposed to the same flaw set.
CERT Polska said the combined exploit leaves a failed-login record associated with a distinctive username value. Because public logs matched that pattern, the researchers believe MikroTrick was exploited before the patches were released. That remains the researchers’ assessment rather than a complete measurement of exploitation at scale.
The case also illustrates the tension in coordinated vulnerability disclosure when exploitation indicators appear before researchers have published full details. Delaying technical information can give administrators time to patch, but defenders may need enough information to recognise compromise while attackers independently analyse the same software changes.
Once updated packages are released, differences between vulnerable and fixed versions can themselves become a source of vulnerability intelligence. CERT Polska’s account shows how quickly that analysis can progress.
The organisation began publishing CVE records on 5 September and said continued restriction of technical details was becoming less useful as independent reconstruction advanced. CVE-2026-86060 was subsequently added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue.
For RouterOS operators, patch state is the immediate distinction. The wider lesson is architectural: remotely administered network devices remain high-value control points, and internet exposure can turn a product vulnerability into a broader enterprise-access problem.
