CERT Polska Dissects the MikroTrick RouterOS Exploit
Following MikroTik’s abrupt release of an emergency security update, the elite CERT Polska team required approximately one hour of forensic analysis to pinpoint the underlying critical vulnerability. By meticulously scrutinizing the architectural modifications within RouterOS, they successfully reverse-engineered the precise exploitation path leading to unauthenticated, total administrative access. A substantial portion of this complex binary analysis was autonomously executed by sophisticated AI agents utilizing the GPT-5.5-cyber and GPT-5.6-sol models. Nevertheless, the human specialists emphatically underscore that they subsequently verified every AI-generated conclusion within a rigorously isolated laboratory environment.
The sequence of events commenced on September 3, when MikroTik almost simultaneously deployed RouterOS versions 7.24.2, 7.23.4, 6.49.21, and 7.25beta3. The vendor designated the update as critical without immediately disclosing the precise technical vulnerability. This conspicuous urgency rapidly captured the attention of the global cybersecurity community. Concurrently, compromised device logs circulating online revealed a bizarre intrusion pattern: RouterOS initially documented a failed login attempt by a user designated as “-2”. Astonishingly, within that exact same session, a new user account named “ops” instantaneously materialized, possessing unfettered administrative privileges. The initial fragments of real-world exploitation telemetry emerged practically the moment the patches were published.
The Mechanics of the MikroTrick Exploit Chain
A meticulous comparison between the legacy and updated firmware builds revealed that MikroTik introduced a crucial username validation check prior to transmitting data to the internal /nova/bin/login daemon. The CERT Polska team aggressively correlated this architectural shift with the anomalous attack logs, isolating CVE-2026-86060 within a single hour. This devastating vulnerability permitted a maliciously crafted username to directly manipulate the arguments passed to the internal utility, ultimately forging a privilege mask that RouterOS erroneously trusted as legitimate.
However, this single CVE was demonstrably insufficient to achieve unauthenticated access. The indispensable second link in this exploit chain materialized as CVE-2026-67279, a critical flaw residing within the native RouterOS SSH server architecture. If an attacker cunningly initiated a key renegotiation prior to finalizing the initial authentication handshake, the server could erroneously transition into processing the user session, despite the absolute lack of a successful login. This devastating synergy of two distinct errors, formally dubbed MikroTrick, granted adversaries a full administrative console without requiring a password, a valid SSH key, or even the completion of the standard authentication protocol.
This comprehensive analysis also rectifies the widespread confusion surrounding a distinct vulnerability, CVE-2026-67276. While that specific error did indeed permit SSH key validation bypass, it fundamentally necessitated prior knowledge of a valid username and a fragment of the authorized RSA key data. Conversely, the catastrophic MikroTrick chain operates entirely devoid of any legitimate credentials, relying exclusively upon the lethal combination of CVE-2026-67279 and CVE-2026-86060.
Leveraging AI Agents in Vulnerability Research
Crucially, CERT Polska did not employ artificial intelligence as a rudimentary, single-prompt chatbot. The team architected a formidable automated laboratory comprising 40 RouterOS CHR virtual machines, 39 distinct system snapshots, and 24 discrete RouterOS releases spanning from version 6.43.11 to 7.25beta3. The AI agents autonomously orchestrated these virtual environments, executing complex version comparisons and dissecting binary files via radare2 and Ghidra. They systematically cross-referenced the observed SSH behavior against official RFC specifications, relentlessly probing for anomalous state transitions within the cryptographic protocol. Ultimately, the agents’ systematic interrogation of key renegotiation sequences prior to authentication completion directly unearthed the second crucial component of the exploit chain.
Active Exploitation and Remediation Imperatives
This threat is demonstrably active. The earliest publicly available intrusion logs originate on September 2, predating the official patches released on September 3. Numerous documented incidents consistently feature the anomalous “-2” login attempt, the illicit creation of the privileged “ops” account, and the subsequent exfiltration of diagnostic telemetry from the compromised router. MikroTik urgently implores all administrators to upgrade immediately to version 6.49.21, 7.23.4, 7.24.2, or newer. Furthermore, administrators must ruthlessly isolate the SSH service from untrusted networks and meticulously audit configurations for unknown users, illicit scripts, and unauthorized modifications.
In their exhaustive MikroTrick technical analysis, CERT Polska emphasizes that the formidable speed of the AI agents did not supplant the necessity for rigorous human verification. The specialists systematically validated every AI hypothesis through redundant testing on pristine systems, negative control checks, and comparative analysis across multiple RouterOS iterations. The paramount advantage of the AI agents manifested in their extraordinary capacity to rapidly iterate through highly atypical states within a profoundly complex cryptographic protocol, automating arduous research that historically demanded exponentially more time.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
