MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key

Summary

Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at

Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.