MikroTrick: Inside the RouterOS Takeover Chain
Attackers exploited a chain in MikroTik RouterOS, dubbed MikroTrick, to take over exposed routers without credentials before fixes were publicly disclosed. CVE-2026-67279 bypasses SSH authentication after rekeying, while CVE-2026-86060 can turn a crafted username into a trusted administrative identity on vulnerable RouterOS 7.x builds. Update to 6.49.21, 7.23.4, 7.24.2, or later, and investigate routers for persistent privileged accounts, scripts, and scheduled tasks because patching alone does not remove an existing compromise.
TL;DR
Attackers found a way to take control of internet-exposed MikroTik routers without a password before official fixes were publicly available. Bishop Fox reproduced the attack and found signs of compromise on real devices, confirming that this was not merely a theoretical risk.
Because routers sit between homes, organizations and the internet, a compromised device can expose traffic, credentials, and the networks behind it. Installing the update prevents new exploitation but does not remove access to an already established attacker. Organizations should patch affected routers immediately and investigate them for indicators of compromise.…