As reported by The Hacker News, CERT Polska has detailed a pre-authentication takeover chain affecting MikroTik RouterOS devices that combines two vulnerabilities — an SSH state-machine bypass and an argument-injection flaw in the login binary. The chain requires no credentials, no SSH key, and no user interaction. It is, by any reasonable definition, a worst-case scenario for edge device security.
Vulnerability Details
| CVE | Type | Severity | Patch Status | Active Exploitation |
|---|---|---|---|---|
| CVE-2026-67279 | SSH state-machine flaw — key renegotiation during auth skips authentication confirmation | Critical | Patched in RouterOS 6.49.21, 7.23.4, 7.24.2 | Yes — observed since at least Sept 2, 2026 |
| CVE-2026-86060 | Argument injection in /nova/bin/login — username treated as CLI option | Critical | Patched in same releases | Yes — chained with CVE-2026-67279 |
Why This Chain Is Dangerous
Individually, each flaw has limited impact. Together, they form a complete authentication bypass. CVE-2026-67279 lets an unauthenticated client reach the post-auth command phase by triggering SSH key renegotiation mid-handshake — the server never sends SSH_MSG_USERAUTH_SUCCESS, but proceeds as if it had. CVE-2026-86060 then exploits the fact that RouterOS passes the username as an unchecked argument to /nova/bin/login. Sending -2 as the username instructs the login binary to read credentials and privilege level from file descriptor 2 (the SSH terminal), which the attacker controls. The result is a full administrative shell with zero credentials exchanged.
This is a textbook example of why chaining logic matters more than individual CVSS scores. Neither bug alone grants access; the combination is devastating.
Who Is at Risk
- Primary: Any MikroTik router with SSH (port 22 or custom) reachable from the internet. MikroTik devices are disproportionately common in ISP, SMB, and WISP deployments.
- High-risk configurations: Devices running RouterOS versions prior to 6.49.21, 7.23.4, or 7.24.2 with SSH enabled on WAN interfaces.
- Secondary risk: Compromised routers serve as persistent C2 relay points, traffic interceptors, or pivots into internal networks — the router itself is rarely the final target.
Detection
The attack leaves a telltale artifact in device logs: a failed login attempt for the username -2. Defenders should grep historical logs immediately. Additionally, watch for unexpected SSH key renegotiation patterns in traffic captures targeting RouterOS devices.
Shield53 Recommendations
Immediate Actions
-2 in failed authentication entries. Any hit on an unpatched device should trigger full incident response — assume persistence and lateral movement.Broader Implications
This chain reinforces a persistent problem: edge devices with SSH exposed to the internet are liabilities, not conveniences. MikroTik routers are widely deployed in cost-sensitive environments where security hygiene is often secondary. The fact that exploitation predates the patch by at least one day suggests either a leak of the vulnerability details or independent discovery by threat actors. Organizations should assume any internet-exposed MikroTik device running a vulnerable version during September 2026 is potentially compromised and act accordingly.