MikroTrick Chain: Hackers Can Hijack MikroTik Routers Without a Password

Robert Moore · 2026-09-23

Imagine someone walking into your house without a key, without picking the lock, and without even knocking. That's essentially what security researchers just found in millions of MikroTik routers around the world. Two separate SSH vulnerabilities in MikroTik's RouterOS can be chained together to give an attacker full administrative control of any internet-exposed router. No password needed. No SSH key. No completed authentication of any kind. CERT Polska, the Polish computer emergency response team, gave this attack chain a name: MikroTrick. ### What Exactly Is MikroTrick? MikroTrick isn't one bug. It's two bugs working together like a one-two punch. The first is an SSH state-machine flaw tracked as CVE-2026-67279. The second is an argument-injection bug in the RouterOS login process, tracked as CVE-2026-86060. On their own, each flaw might be annoying. Together, they're catastrophic. The state-machine flaw lets an attacker manipulate how the SSH service handles the connection lifecycle, and the argument-injection bug lets them sneak commands into the login process. Chain them, and you're in. > "The most dangerous vulnerabilities aren't the ones that break down the door. They're the ones that convince the door to open itself." — common sentiment among network security researchers ### Why This Matters More Than You Think MikroTik routers are everywhere. They're popular with small businesses, ISPs, and home labs because they're affordable and powerful. That popularity is exactly what makes this attack chain so concerning. If your router is exposed to the internet and you haven't patched it, an attacker could: - Take full administrative control of the device - Redirect or intercept your network traffic - Install persistent backdoors that survive reboots - Use your router as a launchpad for attacks on other networks - Quietly monitor everything passing through your connection And here's the scary part: attack logs for this chain date back to at least late 2025, meaning real attackers may have already been using it in the wild before it was publicly disclosed. ### Who's Actually at Risk? Not every MikroTik owner needs to panic. The attack specifically targets routers with SSH exposed to the internet. If your router's SSH port is closed to the outside world, or if you've restricted access to specific IP addresses, you're in much better shape. But if you've ever enabled remote SSH access for convenience and forgotten about it, that's a problem. It's the digital equivalent of leaving a window unlocked for years because you meant to close it "someday." ### What You Should Do Right Now The fix is straightforward, even if the vulnerability isn't: - Update RouterOS to the latest stable version immediately - Disable SSH access from the WAN side if you don't absolutely need it - Restrict SSH to specific trusted IP addresses if remote access is required - Change default credentials and enable two-factor authentication where possible - Monitor your router logs for unusual SSH connection attempts If you're not sure whether your router is exposed, you can check from an external network using a simple port scan tool. If port 22 responds from the outside, you have work to do. ### The Bigger Lesson Here This isn't just a MikroTik story. It's a reminder that chained vulnerabilities are often far more dangerous than any single bug. Attackers don't need a perfect exploit when two mediocre ones will do the job. It's also a nudge to think about your entire network perimeter. Every service you expose to the internet is a potential doorway. The question isn't whether someone will try the handle. It's whether you've locked it. For privacy-conscious users running antidetect browsers and layered security setups, this is a good moment to audit your physical network too. Your browser fingerprint might be locked down tight while your router is quietly waving strangers inside.