MicroTrick: MikroTik RouterOS Unauthenticated Takeover Exploit PoC (CVE-2026-86060)
github.com | vulnerability | Critical | Actively exploited | CVE-2026-86060 | #active-exploitation | #rce | #zero-day | #authentication-bypass | #red-team | #poc | #ssh | #cisa-kev | #mikrotik | #routeros | #cve-2026-86060
Summary
MicroTrick provides a standalone Python exploit for the MikroTik RouterOS attack chain (CVE-2026-86060, CVE-2026-67279), which has been actively exploited in the wild and cataloged by CISA KEV. By chaining an SSH pre-auth key rekeying authentication bypass with an SSH helper defect that parses negative usernames as file descriptors to replace the policy mask, an unauthenticated attacker can gain full administrator privileges over SSH. Patched across RouterOS branches (7.24.2, 7.23.4, 6.49.21).
Why it matters
MikroTik routers form critical edge infrastructure worldwide; with confirmed active exploitation in the wild and public PoC code available, unpatched edge devices face immediate risk of remote takeover.
- CVE
- CVE-2026-86060
- Vendor
- MikroTik
- Product
- RouterOS
- Affected versions
- [7.24, 7.24.2), [7.0.0, 7.23.4), [6.0.0, 6.49.21)
- CVSS
- 9.2
- Published
- Collected
📦 Full-Text Content Snapshot
R2 Archive · Full Article PreservedPublished by DigiProSec · Source: github.com/digiprosec/MicroTrick
poc_mikrotrick.py is a self-contained exploit for the SSH attack chain that CERT Polska disclosed as "MikroTrick" on 2026-09-05, exploited in the wild since at least 2026-09-02 against internet-facing MikroTik RouterOS devices. A single run turns an unauthenticated SSH connection into a full administrator console. No credentials, no user interaction.
The three CVEs
| CVE | Role in the chain | Defect |
|---|---|---|
| CVE-2026-86060 (CVSS 9.2) | Privilege escalation | The SSH login helper treats a dash-led username as a file descriptor and reads a replacement identity and policy mask from it |
| CVE-2026-67279 (CVSS 6.9) | Authentication bypass | A client-requested rekey before authentication drops the server's "must be authenticated" gate |
| CVE-2026-67277 (CVSS 8.8) | Not used by this PoC | The bandwidth-test (btest) service allows pre-auth memory disclosure and restart; relevant for fingerprinting and exposure assessment |
An additional, unnamed state bug is required: a rejected login leaves the username pending in the server's session state. The exploit relies on it in step 1 below. MikroTik's patches (2026-09-03) close the entire chain.
How the exploit works
- Pending username. The client attempts password authentication as the username
-2. The server rejects it but leaves it pending in the session state. This is the campaign's first IoC:login failure for user -2. - Pre-auth rekey (CVE-2026-67279). A key re-exchange before authentication completes makes the server drop its authentication gate.
- Channel open + PTY. A session channel is opened without authentication, and the interactive shell spawns the login helper with the pending
-2. - Policy-mask swap (CVE-2026-86060). The login helper reads up to 4096 bytes from file descriptor 2 and splits them on NUL into a replacement identity and policy mask. The exploit sends an all-ones mask, which RouterOS clamps to the full policy set. The session comes up as full administrator; further actions are logged as
ssh:-2@<ip>, the campaign fingerprint.
The exploit plants a full-privilege test account (hacker / hacker), prints the login command, and exits. (The exploited console itself is unstable — a later rekey re-arms the authentication gate and the channel dies — so a normal SSH login is the durable path.)
Usage
python3 poc_mikrotrick.py <host> # plant hacker account, print ssh login
python3 poc_mikrotrick.py <host> "<ros command>" # run one command, exitRequirement: python3-paramiko. The script is a lab client and refuses non-private IP targets.
Affected and fixed versions
- Vulnerable: RouterOS
[7.24, 7.24.2),[7.0.0, 7.23.4),[6.0.0, 6.49.21) - Fixed: 7.25beta3, 7.24.2, 7.23.4, 6.49.21
- Tested: CHR 7.23.3 (exploitable) vs CHR 7.23.4 (exploit correctly fails). Deterministic across repeated runs.
Detection
- Log line
login failure for user -2 via ssh - Log lines
user <name> added by ssh:-2@<ip> - Unknown highly privileged account
ops /system/device-mode/printshowing the "Flagged" marker (its absence proves nothing)
If any of these appear on a device, treat it as compromised: isolate, patch, and review all users, scripts, scheduler tasks, and tunnels.
References
- CERT Polska disclosure
- MikroTik security bulletin (2026-09-03)
- CISA Known Exploited Vulnerabilities: CVE-2026-86060, CVE-2026-67277 (added 2026-09-10)
Legal
Run this only against RouterOS instances you own or are explicitly authorized to test. Attacking devices you do not own is a crime.
📦 Full-Text Markdown Snapshot archived by Phying News · Original source: github.com
--- id: 8841 canonical_url: "https://phying.com/item/8841" title: "MicroTrick: MikroTik RouterOS Unauthenticated Takeover Exploit PoC (CVE-2026-86060)" type: "vulnerability" cve: "CVE-2026-86060" cvss: 9.2 severity: "critical" vendor: "MikroTik" product: "RouterOS" affected_versions: "[7.24, 7.24.2), [7.0.0, 7.23.4), [6.0.0, 6.49.21)" source_domain: "github.com" source_url: "https://github.com/digiprosec/MicroTrick" published_at: "2026-09-22T13:41:14Z" snapshot_at: "2026-10-26T05:55:00Z" archived_by: "Phying News (https://phying.com/item/8841)" lang: "en" --- # MicroTrick PoC — CVE-2026-86060 (RouterOS unauthenticated full takeover) *Published by DigiProSec · Source: [github.com/digiprosec/MicroTrick](https://github.com/digiprosec/MicroTrick)* `poc_mikrotrick.py` is a self-contained exploit for the SSH attack chain that CERT Polska disclosed as **"MikroTrick"** on 2026-09-05, exploited in the wild since at least 2026-09-02 against internet-facing MikroTik RouterOS devices. A single run turns an unauthenticated SSH connection into a full administrator console. No credentials, no user interaction. ## The three CVEs | CVE | Role in the chain | Defect | | :--- | :--- | :--- | | **CVE-2026-86060** (CVSS 9.2) | Privilege escalation | The SSH login helper treats a dash-led username as a file descriptor and reads a replacement identity and policy mask from it | | **CVE-2026-67279** (CVSS 6.9) | Authentication bypass | A client-requested rekey before authentication drops the server's "must be authenticated" gate | | **CVE-2026-67277** (CVSS 8.8) | Not used by this PoC | The bandwidth-test (btest) service allows pre-auth memory disclosure and restart; relevant for fingerprinting and exposure assessment | An additional, unnamed state bug is required: a rejected login leaves the username pending in the server's session state. The exploit relies on it in step 1 below. MikroTik's patches (2026-09-03) close the entire chain. ## How the exploit works 1. **Pending username.** The client attempts password authentication as the username `-2`. The server rejects it but leaves it pending in the session state. This is the campaign's first IoC: `login failure for user -2`. 2. **Pre-auth rekey (CVE-2026-67279).** A key re-exchange before authentication completes makes the server drop its authentication gate. 3. **Channel open + PTY.** A session channel is opened without authentication, and the interactive shell spawns the login helper with the pending `-2`. 4. **Policy-mask swap (CVE-2026-86060).** The login helper reads up to 4096 bytes from file descriptor 2 and splits them on NUL into a replacement identity and policy mask. The exploit sends an all-ones mask, which RouterOS clamps to the full policy set. The session comes up as full administrator; further actions are logged as `ssh:-2@<ip>`, the campaign fingerprint. The exploit plants a full-privilege test account (`hacker` / `hacker`), prints the login command, and exits. (The exploited console itself is unstable — a later rekey re-arms the authentication gate and the channel dies — so a normal SSH login is the durable path.) ## Usage ```bash python3 poc_mikrotrick.py <host> # plant hacker account, print ssh login python3 poc_mikrotrick.py <host> "<ros command>" # run one command, exit ``` Requirement: `python3-paramiko`. The script is a lab client and refuses non-private IP targets. ## Affected and fixed versions - **Vulnerable**: RouterOS `[7.24, 7.24.2)`, `[7.0.0, 7.23.4)`, `[6.0.0, 6.49.21)` - **Fixed**: 7.25beta3, 7.24.2, 7.23.4, 6.49.21 - **Tested**: CHR 7.23.3 (exploitable) vs CHR 7.23.4 (exploit correctly fails). Deterministic across repeated runs. ## Detection - Log line `login failure for user -2 via ssh` - Log lines `user <name> added by ssh:-2@<ip>` - Unknown highly privileged account `ops` - `/system/device-mode/print` showing the "Flagged" marker (its absence proves nothing) If any of these appear on a device, treat it as compromised: isolate, patch, and review all users, scripts, scheduler tasks, and tunnels. ## References - [CERT Polska disclosure](https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/) - [MikroTik security bulletin (2026-09-03)](https://mikrotik.com/supportsec/september-2026-vulnerability/) - CISA Known Exploited Vulnerabilities: CVE-2026-86060, CVE-2026-67277 (added 2026-09-10) ## Legal Run this only against RouterOS instances you own or are explicitly authorized to test. Attacking devices you do not own is a crime. --- > 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/8841) · Original source: [github.com](https://github.com/digiprosec/MicroTrick)