MikroTik RouterOS WebFig /jsproxy unauthenticated file read via stale session pointer

CVE-2026-67279 / CVE-2026-86060, MikroTik RouterOS "MikroTrick": an SSH rekey-during- authentication state-confusion bypass chained with a crafted-username privilege escalation reaches unauthenticated full device takeover, actively exploited

CERT Polska (NASK) coordinated disclosure of six MikroTik RouterOS vulnerabilities on 2026-09-05, naming the combination that yields unauthenticated full device takeover "MikroTrick," and states plainly that it has independent confirmation of ongoing, successful attacks against RouterOS devices whose SSH service is reachable from the internet (CERT Polska, 2026-09-05). The exploited chain combines two flaws in RouterOS's SSH authentication path. CVE-2026-67279 (CVSS 6.9) is a protocol state-confusion defect: when a client initiates an SSH key re-exchange before completing user authentication, the RouterOS SSH server "unconditionally moved from the temporary rekey state to channel handling instead of resuming the interrupted authentication," accepting a session channel despite never sending SSH_MSG_USERAUTH_SUCCESS (CERT Polska, technical analysis, 2026-09-22). This does not by itself grant an authenticated identity or any privilege, but it is the precondition CVE-2026-86060 (CVSS 9.2, CWE-88 argument injection) then abuses: RouterOS's login helper accepts a username beginning with a hyphen as a command-line option rather than literal text, so a username of "-2" makes the helper read a replacement username and policy mask from file descriptor 2 (the same pseudoterminal the SSH channel already controls) letting the attacker supply their own privilege mask over the SSH channel itself and escalate to full administrative privilege (CERT Polska, technical analysis, 2026-09-22). No credential, no key, and no completed authentication stands between internet reach to the SSH port and full device compromise. A third, narrower flaw, CVE-2026-67276, was wrongly associated with this chain in some earlier reporting; CERT Polska's own technical write-up states it "is a separate vulnerability that allows an attacker to impersonate a user authenticated with an RSA key," requiring the target account name and RSA modulus in advance and granting access only to that one account; "significantly less suitable for a mass attack that works regardless of device configuration" (CERT Polska, technical analysis, 2026-09-22), and it is not confirmed separately exploited.

An independent researcher's reverse-engineering of the silent 2026-09-03 patch traces the mechanics of the crafted-username step in more detail: the SSH daemon invokes a legacy login helper via a system call, passing the authenticated username and a decimal policy-mask value as trailing positional arguments, and that helper's undocumented legacy transport treats any positional argument beginning with a hyphen as a file-descriptor number, reading up to 4096 bytes from it and splitting the result on null bytes into a replacement identity and a replacement policy mask (Nick Pratley, 2026-09-04). The researcher reproduced full policy-mask override once a username matching this pattern was accepted, but did not reproduce a stock, credential-free way to make SSH accept that username in the first place, leaving CERT Polska's combination of the two coordinated CVEs, rather than this third-party analysis, as the authoritative description of the unauthenticated attack path. CERT Polska's own investigation of the observed intrusions found the operators create a highly-privileged local account after exploitation, with the log sequence recording a failed login for a numeric pseudo-user immediately followed by that user's creation over the same SSH session, and states this activity has been occurring since at least 2026-09-02 (CERT Polska, 2026-09-05).

Three further CVEs round out the coordinated disclosure at lower severity, alongside CVE-2026-67276 above. CVE-2026-67277 (CVSS 8.8) lets an unauthenticated client reach the bandwidth-test service's post-authentication code path; combined with disclosure of uninitialized kernel packet-buffer contents and an integer-underflow size-validation bug, this yields kernel memory leakage or a remote denial-of-service that restarts the device (CERT Polska, CVE detail page, 2026-09-05); CISA added it to its Known Exploited Vulnerabilities catalog on 2026-09-10, confirming active in-the-wild exploitation (CISA KEV, catalogue version 2026.09.10). CVE-2026-67278 and CVE-2026-67281 are not confirmed separately exploited. CVE-2026-67278 (CVSS 6.3) lets an attacker who can intercept or redirect an outbound RouterOS TLS connection forge a trusted intermediate certificate for arbitrary hostnames, because RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation and its trust store ships a root CA with public exponent 3, enabling TLS server impersonation against the device's own outbound connections without the root's private key. CVE-2026-67281 (CVSS 8.7) is an unauthenticated file-read in the WebFig /jsproxy path: a newly allocated session retains a stale, uninitialized pointer used for file-authorization checks, and an attacker who can influence allocator state and supplies parent-directory traversal components in an encrypted URI can escape the WebFig file namespace and disclose root-owned files, including credential-bearing configuration stores.

Five of the six are fixed in RouterOS 7.25beta3, 7.24.2, 7.23.4 and 6.49.21, released 2026-09-03; CVE-2026-67278 is not, because those releases carried an incomplete fix for it and it is resolved only in 7.23.6 (long-term) and 7.24.3 (stable) (CERT Polska, CVE detail page). On the releases that do fix their five, MikroTik pushed a first-ever in-app push notification to administrators alongside the release (CERT Polska, 2026-09-05). The fixed releases add a startup "Flagged" self-check that scans configuration for known post-compromise traces, disables recognized suspicious entries, and logs a critical warning, but CERT Polska is explicit that this mechanism detects only selected traces left after a compromise, and its absence is not proof that a device is safe (CERT Polska, 2026-09-05).

CERT Polska states the six flaws were found using an agentic research environment built on OpenAI's GPT-5.5-cyber and GPT-5.6-sol models under the OpenAI Government and Trust Agency Collaboration program, automating protocol-state-machine modelling and binary-diff hypothesis generation inside an isolated RouterOS lab, with every hypothesis confirmed on real hardware before publication (CERT Polska, 2026-09-05), a national CERT's AI-augmented research pipeline producing an actively-exploited, pre-auth full-device-takeover chain.

Detection concept, telemetry class first: on-device system-log review is the primary hunt surface here, since these are commodity routers with no EDR agent. Alert on any SSH login-failure log entry for a non-standard, negative-looking numeric pseudo-username, especially one immediately followed within the same session window by a new-user-creation log entry, CERT Polska's own observed intrusions show exactly this sequence. Independently alert on creation of any locally-administered account with full or administrative group membership that does not correlate to a known change-management action. For the WebFig file-disclosure path, web-access logs showing /jsproxy requests carrying encoded parent-directory traversal sequences are the anchor; for the bandwidth-test flaw, unexpected inbound connections to that service from unauthenticated sources, or device reboots correlated with such connections, are the observable. Triage: a device's own "Flagged" status is a useful positive signal but never a negative one, treat it as one input alongside the log markers above, not as a clearance check, per the vendor and CERT Polska's shared caution.