RouterOS at the Network Edge: Operational Risk From CVE-2026-67279 and CVE-2026-86060
Vulnerability overview
Most vulnerability write-ups describe mechanism. This one starts from position, because the position is what makes the MikroTrick chain in MikroTik RouterOS worth a management conversation. RouterOS devices commonly sit on the boundary between an organisation and the internet, and the two flaws fixed on 3 September 2026 - CVE-2026-67279 and CVE-2026-86060 - end at full administrative control of precisely that device.
Mechanism and exploitation conditions
The first defect mishandles an SSH rekey performed during authentication and advances to the channel phase without an authenticated identity. The second has the login helper read a hyphen-prefixed username as an option and take its policy mask from the pseudo-terminal the attacker is writing to. Neither step checks a password, and neither needs a key.
For risk assessment, three properties matter. The attack is unauthenticated, so it is remotely automatable. It targets a management listener, so it does not require a separate foothold. And it terminates in full policy, so it is not a constrained primitive that needs further escalation.
Impact
Control of an edge router has downstream effects that a host compromise does not. Routing changes redirect or intercept traffic. Firewall and NAT edits create paths that were meant to be closed. VPN and IPsec keys let an attacker maintain access after the vulnerability is patched. Account creation provides a persistence mechanism that survives reboots and updates.
Observed activity matched that profile. Public logs from the campaign show a privileged ops account created over SSH and a device diagnostic file exported to an external address with fetch. The second detail suggests the intruder wanted to understand the environment rather than simply hold it.
Affected products and scope
The September 2026 fixes cover RouterOS 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. Devices that were internet-facing before that date need a post-patch review even if they are now current.
ZoomEye measurement for this topic used os="RouterOS" && service="ssh" and returned 9,559 devices. That is a reachability figure for RouterOS SSH management listeners and should be read as the size of the population that had to make a patching decision, not as a verified vulnerability count.
Remediation and mitigations
- Treat RouterOS updates as scheduling-critical and move devices onto fixed builds promptly.
- Eliminate public management reachability where possible; where it is not, bound it to administrative networks.
- Audit accounts and the firmware's Flagged status after patching.
- Review SSH logs for hyphen-prefixed usernames across the exposure window, not just since the update.
- Rotate all secrets stored on devices that show findings, and re-baseline routing and firewall configuration.
- Where the router is a chokepoint for regulated traffic, involve the risk owner before declaring the incident closed.
References
- CERT Polska, "MikroTrick: technical analysis, disclosure process and use of LLM agents" - https://cert.pl/posts/2026/09/mikrotrick-analiza-techniczna/
- MikroTik RouterOS release notes, September 2026 maintenance branches
- CISA Known Exploited Vulnerabilities catalog
- RFC 4252 and RFC 4254 (SSH authentication and connection protocols)
