CVE-2026-67279 & CVE-2026-86060: MikroTik RouterOS 'MikroTrick' Authentication Bypass — Detection and Remediation Guide

CERT Polska has disclosed a chained vulnerability they call MikroTrick that allows unauthenticated attackers to seize full administrative control of Internet-exposed MikroTik routers — no password, no SSH private key, and critically, no completed authentication handshake. The chain combines an SSH state-machine flaw in RouterOS (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060), and attack logs indicate exploitation activity dating back well before public disclosure.

This is as bad as perimeter device compromises get. MikroTik hardware sits at the network edge for hundreds of thousands of ISPs, MSPs, and small-to-mid-size enterprises worldwide. A compromised RouterOS device is not just a foothold — it is a man-in-the-middle position. Attackers who control your router control DNS resolution for the entire network behind it, can intercept or redirect traffic, harvest credentials in cleartext protocols, and pivot into internal segments without touching a single endpoint EDR agent. Edge device compromise is also notoriously under-monitored: most organizations forward little or no telemetry from their routers, which is precisely why actors favor them for persistence.

If you have RouterOS devices with SSH reachable from the Internet — and our experience from past MikroTik campaigns (VPNFilter, Meris, the CVE-2018-14847 ecosystem abuse) says many of you do — treat this as an emergency patch-and-hunt event.

Technical Analysis

The Chain

MikroTrick is a two-stage chain, and both stages matter:

Stage 1 — CVE-2026-67279 (SSH state-machine flaw). RouterOS's SSH service improperly handles the authentication state machine, allowing an attacker to reach code paths that should only be accessible after successful authentication — without ever completing the handshake. From a defender's perspective, the key implication is that classic SSH brute-force and failed-login telemetry may look clean. The attacker isn't logging in and failing repeatedly; they are manipulating the session state to bypass the gate entirely. Detections tuned purely on authentication failure counts will miss this.

Stage 2 — CVE-2026-86060 (argument injection in the login process). With the state machine bypassed, the attacker injects crafted arguments into the RouterOS login process, which executes with elevated privileges and yields full administrative (root-equivalent in RouterOS terms) control of the device.

Chained together: no credentials, no key material, no valid account — and the result is total device ownership. Post-exploitation follows the well-established MikroTik playbook: creation of additional admin users, modification of firewall and NAT rules, DNS hijacking via RouterOS static DNS entries, scheduler tasks running attacker-controlled scripts for persistence, and in many historical campaigns, SOCKS proxy or traffic-redirection configuration to monetize or weaponize the device.

Affected Products

• MikroTik RouterOS — devices running vulnerable versions with the SSH service exposed (port 22/TCP), particularly those reachable from the Internet.
• Both CHR (Cloud Hosted Router) and physical RouterBOARD deployments are in scope where the vulnerable SSH daemon is exposed.

CERT Polska and MikroTik's advisories should be consulted for the precise vulnerable and fixed version ranges — verify against the official sources listed in the Remediation section below rather than assuming your train is unaffected.

Exploitation Status

• Confirmed in-the-wild activity. CERT Polska's reporting notes attacker logs predating disclosure, meaning this was exploited as a zero-day or near-zero-day before defenders had any signal.
• No completed authentication required. The barrier to entry is an exposed SSH port — Shodan/Censys-scale scanning is sufficient to build a target list.
• CISA KEV: monitor the Known Exploited Vulnerabilities catalog; edge-device auth bypasses with confirmed exploitation are routinely added, typically with aggressive federal remediation deadlines that private-sector teams should adopt as their own SLA.

Historical precedent here is grim: MikroTik botnets have been repeatedly built from exactly this class of bug, and devices compromised via router-level access are frequently not cleaned even after patching unless the configuration is audited and the device is inspected for persistence.

Detection & Response

The highest-fidelity detections for MikroTrick come from RouterOS syslog forwarding. If your routers are not shipping logs to your SIEM, that is gap number one — enable remote syslog (/system logging action) to a collector that lands in Sentinel or your platform of choice. Post-exploitation behaviors (new admin accounts, DNS/NAT changes, scheduler persistence) are the most reliable signals because the initial bypass may not log as a failed authentication.

---
title: MikroTik RouterOS Administrative Account Creation
description: Detects creation of new user accounts on MikroTik RouterOS devices via syslog. New admin users are a primary persistence mechanism following MikroTrick (CVE-2026-67279 / CVE-2026-86060) exploitation.
logsource:
  product: mikrotik
  service: system
detection:
  selection:
    Message|contains:
      - 'user added'
      - 'added by'
  filter_known_admins:
    Message|contains:
      - 'by admin'
  condition: selection and not filter_known_admins
falsepositives:
  - Legitimate user provisioning by non-default administrator accounts
level: high
---
title: MikroTik RouterOS Critical Configuration Change - DNS Firewall Scheduler
description: Detects high-impact RouterOS configuration modifications associated with post-exploitation activity, including DNS static entries, NAT/firewall changes, and scheduler-based persistence.
logsource:
  product: mikrotik
  service: system
detection:
  selection:
    Message|contains:
      - 'dns changed'
      - 'static dns'
      - 'nat rule'
      - 'firewall rule added'
      - 'scheduler'
      - 'script added'
      - 'script changed'
falsepositives:
  - Documented change windows by network engineering staff
level: medium
---
title: MikroTik RouterOS SSH Login From Anomalous Source
description: Detects successful SSH logins to RouterOS devices. Correlate against authorized management source addresses - MikroTrick exploitation may produce a successful login event without preceding authentication failures.
logsource:
  product: mikrotik
  service: ssh
detection:
  selection:
    Message|contains: 'logged in from'
    Message|contains: 'via ssh'
falsepositives:
  - Authorized administrator sessions - maintain an allowlist of management source IPs and suppress known-good sources
level: medium

// MikroTrick hunt: RouterOS post-exploitation and SSH anomalies via syslog ingestion
// Requires MikroTik remote syslog forwarded to Sentinel (Syslog or CommonSecurityLog)
let lookback = 14d;
let AuthorizedMgmtSources = dynamic(["10.0.0.0/8"]); // tune to your management network
Syslog
| where TimeGenerated >= ago(lookback)
| where Computer has_any ("mikrotik", "router") or ProcessName has "routeros"
| where SyslogMessage has_any (
    "logged in from", "via ssh",
    "user added",
    "dns changed", "static dns",
    "scheduler", "script added", "script changed",
    "nat rule", "firewall rule added",
    "export", "backup created")
| extend SrcIP = extract(@"logged in from ([0-9.]+)", 1, SyslogMessage)
| extend EventType = case(
    SyslogMessage has "user added", "AccountCreated",
    SyslogMessage has_any ("dns", "nat", "firewall"), "ConfigChange",
    SyslogMessage has_any ("scheduler", "script"), "PersistenceMechanism",
    SyslogMessage has "logged in", "SSHLogin",
    "Other")
| project TimeGenerated, Computer, EventType, SrcIP, SyslogMessage
| order by TimeGenerated desc

-- Hunt admin workstations for evidence of MikroTik compromise response artifacts:
-- outbound SSH to edge devices, downloaded RouterOS backups, and config exports (.rsc/.backup)
LET router_targets = SELECT * FROM netstat()
WHERE (RemoteAddr.Port = 22 OR RemoteAddr.Port = 8291)
  AND Status = 'ESTABLISHED'

LET config_artifacts = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:\\Users\\**\\Downloads\\*.backup',
                 'C:\\Users\\**\\Downloads\\*.rsc',
                 '/home/*/Downloads/*.backup',
                 '/home/*/Downloads/*.rsc'])

SELECT * FROM router_targets
UNION ALL
SELECT FullPath AS Name, Size, Mtime FROM config_artifacts

#!/bin/bash
# MikroTrick audit script - run against each RouterOS device via SSH
# Usage: ./mikrotik_audit.sh <router_ip> <admin_user>
ROUTER=$1
USER=$2

echo "=== RouterOS version (verify against vendor advisory) ==="
ssh ${USER}@${ROUTER} "/system resource print; /system package print"

echo "=== User accounts - flag any unrecognized admin users ==="
ssh ${USER}@${ROUTER} "/user print detail"

echo "=== Scheduler and scripts - primary persistence vector ==="
ssh ${USER}@${ROUTER} "/system scheduler print detail; /system script print detail"

echo "=== DNS static entries - check for hijacked records ==="
ssh ${USER}@${ROUTER} "/ip dns print; /ip dns static print"

echo "=== Firewall/NAT rules - check for unauthorized redirects ==="
ssh ${USER}@${ROUTER} "/ip firewall nat print; /ip firewall filter print"

echo "=== SOCKS/proxy - historical MikroTik botnet monetization ==="
ssh ${USER}@${ROUTER} "/ip socks print; /ip proxy print"

echo "=== Active connections and services ==="
ssh ${USER}@${ROUTER} "/ip service print; /ip firewall connection print count-only"

Remediation

1. Patch immediately. Upgrade RouterOS to the fixed release identified in MikroTik's official advisory and CERT Polska's disclosure. Download updates only from mikrotik.com/download — never via third-party mirrors. Verify the device model/RouterOS architecture before upgrading, and schedule this as an emergency change, not a routine maintenance window.

2. Remove Internet-exposed management interfaces — permanently. Even after patching, SSH and Winbox (8291) should never be reachable from the public Internet. Restrict management to a dedicated management VLAN/VRF or a VPN-only path:

# Restrict SSH to the management network only
/ip service set ssh address=10.10.99.0/24
# Disable unused management services entirely
/ip service disable telnet,ftp,www,api,api-ssl,winbox
# Add an input-filter drop for everything else to the router itself
/ip firewall filter add chain=input action=drop connection-state=new in-interface-list=WAN comment="Drop unsolicited WAN->router"

3. Assume compromise on exposed devices. Patching does not evict an attacker. For every device that had SSH Internet-exposed before patching: audit user accounts, scheduler tasks, scripts, DNS static entries, NAT rules, and SOCKS settings (use the audit script above). If any artifact cannot be attributed to a documented change, export logs, then factory-reset (/system reset-configuration) and rebuild from a known-good, pre-exposure configuration backup — not from a backup taken after exposure began.

4. Rotate all credentials. Router-level admin credentials, and any credentials that traversed the device (especially cleartext protocols), should be considered compromised on a device with confirmed suspicious activity.

5. Enable remote syslog forwarding to your SIEM and import the detections above. Edge devices without telemetry are blind spots attackers will continue to farm.

6. Inventory exposure. Run external attack surface discovery (Shodan, Censys, or your ASM tooling) against your IP space for MikroTik fingerprints — ports 22, 8291, 8728/8729 (API) — and remediate anything found.

Official references: CERT Polska (cert.pl) MikroTrick disclosure and MikroTik's security advisory and download portal (mikrotik.com). Monitor the CISA KEV catalog for addition and any associated federal remediation deadline.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub