> MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key
[DATE: 23/09/2026 16:06]
[LANGUAGE: EN]
Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication.
The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at