MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key
September 23, 2026
1 min read
3 views
cybersecurity
threats
news
Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication.
The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at
Was this article helpful?
0 found this helpful