MikroTrick SSH Chain Bypasses Authentication on Exposed MikroTik Routers via CVE-2026-67279 and CVE-2026-86060

{"The chain exploits SSH protocol sequencing and RouterOS login argument handling. CVE-2026-67279 allows an unauthenticated client to force key renegotiation during the auth phase, skipping SSH_MSG_USERAUTH_SUCCESS and advancing directly to the channel phase. CVE-2026-86060 then passes the username -2 to /nova/bin/login, causing it to read identity and privilege level from the attacker's SSH channel instead of validating input, granting root-equivalent access.","Device logs show a consistent pattern: rejected auth for user -2, forced renegotiation, channel jump, and exec requests to create accounts like ops. CERT Polska documented these traces on the MikroTik forum from September 2, one day before patches in 6.49.21, 7.23.4, and 7.24.2. CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10, confirming active exploitation independent of any state attribution.","MikroTik's default configurations do not expose SSH publicly, yet thousands of devices remain reachable due to user misconfigurations. CVE-2026-67276 is a separate RSA key forgery issue and does not participate in this chain. The pattern matches prior RouterOS exposures where partial auth bypasses combined with local privilege mechanisms produced rapid remote code execution without credential theft.","Operators must isolate or patch exposed SSH immediately. Continued monitoring for -2 login attempts and unexpected user creation will indicate ongoing campaigns. Procurement records show MikroTik devices in critical infrastructure; delayed patching will extend the window for configuration exfiltration observed in diagnostic reports."}