2026-09-06 · view entry permalink →
CVE-2026-67276 / CVE-2026-86060, MikroTik RouterOS "MikroTrick": a forged-signature SSH authentication bypass chained with a crafted-username privilege escalation reaches unauthenticated full device takeover, actively exploited
CERT Polska (NASK) coordinated disclosure of six MikroTik RouterOS vulnerabilities on 2026-09-05, naming the combination that yields unauthenticated full device takeover "MikroTrick," and states plainly that it has independent confirmation of ongoing, successful attacks against RouterOS devices whose SSH service is reachable from the internet (CERT Polska, 2026-09-05). The exploited chain combines two flaws in RouterOS's SSH authentication path. CVE-2026-67276 (CVSS 9.2) is a signature-verification defect: RouterOS matches an incoming SSH public key against the authorized-keys entry on file by comparing only the key type and the RSA modulus, never the exponent (CERT Polska, 2026-09-05). Because signature verification is then performed against the client-supplied key rather than the stored one, an attacker who already knows an authorized user's RSA modulus (a value that is not secret and is recoverable from ordinary key-exchange material in many configurations) can substitute a key with exponent 1, forge a valid signature over it without ever holding the corresponding private key, and open an authenticated SSH command channel as that user (CERT Polska, CVE detail page, 2026-09-05). CVE-2026-86060 (CVSS 9.2, CWE-88 argument injection) is chained immediately after: RouterOS mishandles SSH usernames that begin with a disallowed character in its login path, and a crafted username lets an attacker change the trusted RouterOS policy mask associated with the resulting session, escalating it to full administrative privilege regardless of which account the signature-forgery step targeted (CERT Polska, 2026-09-05). CERT Polska is explicit that exploitation of this second step requires nothing but an unauthenticated SSH session able to reach the RouterOS login helper (CERT Polska, CVE detail page, 2026-09-05), no credential, no privilege, no user interaction stands between internet reach to the SSH port and full device compromise.
An independent researcher's reverse-engineering of the silent 2026-09-03 patch traces the mechanics of the crafted-username step in more detail: the SSH daemon invokes a legacy login helper via a system call, passing the authenticated username and a decimal policy-mask value as trailing positional arguments, and that helper's undocumented legacy transport treats any positional argument beginning with a hyphen as a file-descriptor number, reading up to 4096 bytes from it and splitting the result on null bytes into a replacement identity and a replacement policy mask (Nick Pratley, 2026-09-04). The researcher reproduced full policy-mask override once a username matching this pattern was accepted, but did not reproduce a stock, credential-free way to make SSH accept that username in the first place, leaving CERT Polska's combination of the two coordinated CVEs, rather than this third-party analysis, as the authoritative description of the unauthenticated attack path. CERT Polska's own investigation of the observed intrusions found the operators create a highly-privileged local account after exploitation, with the log sequence recording a failed login for a numeric pseudo-user immediately followed by that user's creation over the same SSH session, and states this activity has been occurring since at least 2026-09-02 (CERT Polska, 2026-09-05).
Four further CVEs round out the coordinated disclosure at lower severity, none confirmed separately exploited. CVE-2026-67277 (CVSS 8.8) lets an unauthenticated client reach the bandwidth-test service's post-authentication code path; combined with disclosure of uninitialized kernel packet-buffer contents and an integer-underflow size-validation bug, this yields kernel memory leakage or a remote denial-of-service that restarts the device (CERT Polska, CVE detail page, 2026-09-05). CVE-2026-67278 (CVSS 6.3) lets an attacker who can intercept or redirect an outbound RouterOS TLS connection forge a trusted intermediate certificate for arbitrary hostnames, because RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation and its trust store ships a root CA with public exponent 3, enabling TLS server impersonation against the device's own outbound connections without the root's private key. CVE-2026-67279 (CVSS 6.9) lets an unauthenticated SSH client that requests a rekey before ever attempting authentication still reach the connection protocol and issue an exec request, letting it create, overwrite or reconstruct files in RouterOS's managed file namespace, including configuration and diagnostic support files. CVE-2026-67281 (CVSS 8.7) is an unauthenticated file-read in the WebFig /jsproxy path: a newly allocated session retains a stale, uninitialized pointer used for file-authorization checks, and an attacker who can influence allocator state and supplies parent-directory traversal components in an encrypted URI can escape the WebFig file namespace and disclose root-owned files, including credential-bearing configuration stores.
All six are fixed in RouterOS 7.25beta3, 7.24.2, 7.23.4 and 6.49.21, released 2026-09-03; MikroTik pushed a first-ever in-app push notification to administrators alongside the release (CERT Polska, 2026-09-05). The fixed releases add a startup "Flagged" self-check that scans configuration for known post-compromise traces, disables recognized suspicious entries, and logs a critical warning, but CERT Polska is explicit that this mechanism detects only selected traces left after a compromise, and its absence is not proof that a device is safe (CERT Polska, 2026-09-05).
CERT Polska states the six flaws were found using an agentic research environment built on OpenAI's GPT-5.5-cyber and GPT-5.6-sol models under the OpenAI Government and Trust Agency Collaboration program, automating protocol-state-machine modelling and binary-diff hypothesis generation inside an isolated RouterOS lab, with every hypothesis confirmed on real hardware before publication (CERT Polska, 2026-09-05), a national CERT's AI-augmented research pipeline producing an actively-exploited, pre-auth full-device-takeover chain.
Detection concept, telemetry class first: on-device system-log review is the primary hunt surface here, since these are commodity routers with no EDR agent. Alert on any SSH login-failure log entry for a non-standard, negative-looking numeric pseudo-username, especially one immediately followed within the same session window by a new-user-creation log entry, CERT Polska's own observed intrusions show exactly this sequence. Independently alert on creation of any locally-administered account with full or administrative group membership that does not correlate to a known change-management action. For the WebFig file-disclosure path, web-access logs showing /jsproxy requests carrying encoded parent-directory traversal sequences are the anchor; for the bandwidth-test flaw, unexpected inbound connections to that service from unauthenticated sources, or device reboots correlated with such connections, are the observable. Triage: a device's own "Flagged" status is a useful positive signal but never a negative one, treat it as one input alongside the log markers above, not as a clearance check, per the vendor and CERT Polska's shared caution.
We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks. It has also been confirmed that the released patches prevent the observed attacks.
RouterOS did not properly verify public keys used for SSH authentication - in particular, it did not compare the entire RSA public key assigned to a user.
Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.
Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.
the successful attacks observed so far, including the creation of the "ops" account
This mechanism detects only selected traces left after a compromise - the absence of the marker is not proof that the device is safe.