MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key

Two MikroTik RouterOS SSH vulnerabilities, CVE-2026-67279 and CVE-2026-86060, have been chained together in an attack technique dubbed MikroTrick by CERT Polska. The exploit allows attackers to gain full administrative control over Internet-exposed MikroTik routers without requiring a password, SSH key, or any completed authentication. CVE-2026-67279 is an SSH state-machine flaw, while CVE-2026-86060 is an argument-injection bug in the RouterOS login process. Attack logs indicate exploitation activity has already been observed in the wild. The combination of these two flaws creates a critical unauthenticated remote compromise vector for a widely deployed networking device.