As reported by The Hacker News, CERT Polska has detailed a pre-authentication takeover chain affecting MikroTik RouterOS devices that combines two vulnerabilities — an SSH state-machine bypass and an argument-injection flaw in the login binary. The chain requires no credentials, no SSH key, and no user interaction. It is, by any reasonable definition, a worst-case scenario for edge device security.

Security Impact: As reported by The Hacker News, CERT Polska has detailed a pre-authentication takeover chain affecting MikroTik RouterOS devices that combines two vulnerabilities — an SSH state-machine bypass and an argument-injection flaw in the login binary.

Vulnerability Details

CVETypeSeverityPatch StatusActive Exploitation
CVE-2026-67279SSH state-machine flaw — key renegotiation during auth skips authentication confirmationCriticalPatched in RouterOS 6.49.21, 7.23.4, 7.24.2Yes — observed since at least Sept 2, 2026
CVE-2026-86060Argument injection in /nova/bin/login — username treated as CLI optionCriticalPatched in same releasesYes — chained with CVE-2026-67279

Why This Chain Is Dangerous

Individually, each flaw has limited impact. Together, they form a complete authentication bypass. CVE-2026-67279 lets an unauthenticated client reach the post-auth command phase by triggering SSH key renegotiation mid-handshake — the server never sends SSH_MSG_USERAUTH_SUCCESS, but proceeds as if it had. CVE-2026-86060 then exploits the fact that RouterOS passes the username as an unchecked argument to /nova/bin/login. Sending -2 as the username instructs the login binary to read credentials and privilege level from file descriptor 2 (the SSH terminal), which the attacker controls. The result is a full administrative shell with zero credentials exchanged.

This is a textbook example of why chaining logic matters more than individual CVSS scores. Neither bug alone grants access; the combination is devastating.

Who Is at Risk

  • Primary: Any MikroTik router with SSH (port 22 or custom) reachable from the internet. MikroTik devices are disproportionately common in ISP, SMB, and WISP deployments.
  • High-risk configurations: Devices running RouterOS versions prior to 6.49.21, 7.23.4, or 7.24.2 with SSH enabled on WAN interfaces.
  • Secondary risk: Compromised routers serve as persistent C2 relay points, traffic interceptors, or pivots into internal networks — the router itself is rarely the final target.

Detection

The attack leaves a telltale artifact in device logs: a failed login attempt for the username -2. Defenders should grep historical logs immediately. Additionally, watch for unexpected SSH key renegotiation patterns in traffic captures targeting RouterOS devices.

Shield53 Recommendations

Immediate Actions

Shield53 Recommendations
Patch now: Upgrade all MikroTik devices to RouterOS 6.49.21, 7.23.4, or 7.24.2 or later. Treat this as emergency maintenance, not scheduled.
Restrict SSH access: Disable SSH on WAN interfaces entirely. Use WinBox or VPN-restricted management. If SSH is required, limit it to specific source IPs via firewall rules.
Hunt for compromise: Search logs for the username -2 in failed authentication entries. Any hit on an unpatched device should trigger full incident response — assume persistence and lateral movement.
Check for persistence: Review scheduled tasks, scripts, and firewall rules on any device that was exposed during the vulnerable window. MikroTik malware commonly establishes backdoors via RouterOS scripting.
Rotate credentials: If a device was exposed and potentially compromised, rotate all stored credentials, certificates, and API keys that transited through or were stored on the router.

Broader Implications

This chain reinforces a persistent problem: edge devices with SSH exposed to the internet are liabilities, not conveniences. MikroTik routers are widely deployed in cost-sensitive environments where security hygiene is often secondary. The fact that exploitation predates the patch by at least one day suggests either a leak of the vulnerability details or independent discovery by threat actors. Organizations should assume any internet-exposed MikroTik device running a vulnerable version during September 2026 is potentially compromised and act accordingly.