Two Bugs and an Exposed SSH Port: The MikroTik RouterOS MikroTrick Chain

CERT Polska disclosed six vulnerabilities in MikroTik RouterOS, two of which combine into an exploitation chain the researchers named MikroTrick. The chain lets an attacker take full control of a device without authentication, provided the device's SSH service is reachable from the internet. Both critical flaws entered CISA's Known Exploited Vulnerabilities catalog, and MikroTik published fixes.
RouterOS runs on edge routers and wireless access points used by small and medium businesses, internet service providers, and home offices. The devices sit at network boundaries, which is why an unauthenticated takeover matters beyond the single appliance.

The two flaws in the chain

CVE-2026-67277 is a defect in SSH login path parameter handling. A username beginning with a restricted character can alter the policy mask, which allows unauthenticated privilege escalation. The input that should be rejected is instead processed in a way that changes the effective policy.
CVE-2026-86060 allows an unauthenticated client to establish a btest session before authentication completes. Btest is RouterOS's bandwidth testing facility. Establishing the session early exposes uninitialized data from a kernel buffer and can cause the device to restart.
Neither flaw requires credentials. The combination gives an attacker control of the device. The prerequisite is network reachability to the SSH service, which is the part defenders control.

Affected versions and fixes

MikroTik's guidance is to upgrade to 7.24.2 on the stable branch, 7.23.4, or 6.49.21 on the long-term branch. The vendor also recommends closing public exposure of port 22 and auditing accounts and login logs for anomalies.
The version guidance is worth reading carefully. Devices that have not been updated in some time may be on branches that no longer receive fixes, in which case the upgrade is also a migration.

Why edge devices are a persistent problem

The security profile of these devices is shaped by how they are operated. They are often deployed for convenience, with the management interface exposed to the internet so the owner can reach it from anywhere. Owners frequently lack dedicated security staff, firmware updates are irregular, and default credentials may remain in place. The result is a large population of devices with reachable management services and outdated software.
Once an attacker controls an edge router, the device becomes useful in several ways. It can be added to a botnet for distributed denial of service, used to forward malicious traffic, used to hijack DNS resolution, or used as a pivot into the internal network behind it. The device's position at the boundary is what gives it value.

What to do in order

1. Inventory RouterOS devices and record the running version and branch.
2. Upgrade to 7.24.2, 7.23.4, or 6.49.21 as appropriate. Plan migration for devices on unsupported branches.
3. Remove public exposure of the SSH service. If remote administration is required, place it behind a VPN or an allowlist rather than leaving port 22 open to the internet.
4. Audit accounts and login logs for unfamiliar entries and for authentication attempts that do not match normal administrative activity.
5. Review device configuration for changes the owner did not make, including firewall rules, DNS settings, and user accounts. The pattern is familiar and it keeps recurring. A device with a reachable management service and an unpatched flaw becomes an entry point. The fix is a version upgrade plus a decision about whether that management service needs to be reachable from the internet at all.

References

• CERT Polska disclosure of six MikroTik RouterOS vulnerabilities, including the MikroTrick chain.
• MikroTik security advisories for CVE-2026-67277 and CVE-2026-86060, fixed in 7.24.2, 7.23.4, 6.49.21.
• CISA Known Exploited Vulnerabilities catalog entries for CVE-2026-67277 and CVE-2026-86060.
• NVD records for CVE-2026-67277 (CVSS 8.8) and CVE-2026-86060 (CVSS 9.2).