MikroTik routers face a critical remote takeover threat from an unauthenticated exploit chain that requires no password or SSH credentials. Security researchers at CERT Polska discovered the flaw, termed MikroTrick, which chains two distinct vulnerabilities in RouterOS to grant full administrative access to internet-exposed devices.
The vulnerability chain combines CVE-2026-67279, an SSH state-machine flaw, with CVE-2026-86060, an argument-injection bug in the RouterOS login process. Together, these defects allow attackers to bypass all authentication mechanisms and execute commands with root privileges on affected routers. The state-machine vulnerability permits attackers to manipulate SSH connection states, while the argument-injection bug injects malicious parameters into the login handler, completing the bypass.
Attack evidence appears in logs dating from early in the discovery period, suggesting the vulnerability may already face active exploitation. This timeline raises concerns about whether threat actors identified and weaponized the chain before public disclosure.
MikroTik routers dominate network infrastructure across small businesses, ISPs, and telecommunications operators worldwide. RouterOS runs on MikroTik hardware and third-party devices, making the affected install base exceptionally broad. Any internet-exposed MikroTik router vulnerable to this chain becomes a direct entry point for full network compromise without requiring brute-force attacks, credential theft, or social engineering.
Once attackers gain administrative access, they can modify firewall rules, redirect traffic, harvest network credentials, deploy persistent malware, or pivot to internal systems. ISPs and telecom operators face particular risk, as compromised routers could facilitate large-scale traffic interception campaigns or BGP hijacking attacks. For enterprise networks, RouterOS devices often sit at network perimeters, making them attractive targets for initial access.
The two CVEs work in concert. The SSH state-machine flaw allows an attacker to enter a state that bypasses standard authentication checks. The argument-injection vulnerability then processes malicious login parameters without proper sanitization, enabling command execution or privilege escalation within that compromised state. Separately, neither flaw provides unauthenticated access, but combined they eliminate all authentication barriers.
MikroTik has not yet published patches as of the reporting date, though disclosure to vendors typically precedes public announcements. Organizations running RouterOS must treat internet-exposed instances as compromise risks until official patches arrive. Network administrators should prioritize restricting SSH access through firewall rules, disabling remote SSH if unnecessary, and implementing network segmentation to limit router compromise impact.
The incident underscores a recurring pattern in network appliance security. Routers present high-value targets because they sit at network boundaries and require constant internet reachability. A single unauthenticated remote code execution chain can grant attackers immediate network dominance. MikroTick also demonstrates how seemingly minor SSH implementation flaws compound into critical vulnerabilities when chained with other defects.
Organizations should immediately review their network architecture to identify internet-accessible MikroTik devices and apply MikroTik's patch when released. For those unable to patch immediately, disabling SSH access and restricting management access to trusted networks only remains essential until updates deploy.