MikroTik router flaws let attackers gain admin access

CERT Polska said CVE-2026-67279 let an SSH client move from authentication into the session stage after a key renegotiation, without the login step being completed. It said CVE-2026-86060 then let RouterOS's login programme treat a username beginning with a hyphen as options, which gave access to a fully privileged console.

The group said the chain left a log pattern showing failed logins for user -2. It said matching entries appeared on the MikroTik forum by 2 September, and that one diagnostic report showed rejected authentication, renegotiation, a jump to the channel stage and an attempt to create an ops user with full privileges before the SSH process crashed.

CERT Polska said other reports showed the ops account being created successfully. It also said some cases involved diagnostic-file creation followed by data transfer to an attacker IP, which it read as evidence that configuration data had been copied.

The article said some publications had incorrectly added CVE-2026-67276 to the chain, but CERT Polska described that flaw as separate and requiring the victim account name and public key. It also said no authoritative count of compromised devices had been published, and that CERT Polska and MikroTik advised administrators to check for the listed indicators, preserve logs, reset affected devices and change credentials.