CERT Polska rebuilt MikroTik's silent RouterOS patch into a working exploit within days

The chain has two parts, and only the second one hands over root.

SSH is meant to keep a client from touching anything until authentication succeeds. RouterOS broke that when a rekey, the routine mid-session renegotiation of encryption keys, arrived while authentication was still in progress. Finish the rekey and the server skipped straight to channel handling as if the client had authenticated. That is CVE-2026-67279, and on its own it only opens a session channel. ^[11][16]

The second bug turns the open channel into administrator access. When a session starts, RouterOS spawns a login process and passes it the username and a numeric privilege level as command-line arguments. The username arrives before authentication finishes, and it is not sanitized. ^[12] An attacker sends "-2" as the username. The login process reads -2 as an option pointing at file descriptor 2, which is wired to the terminal channel the attacker already controls. ^[13] Set the privilege mask to 655358, the fully privileged group, and the session returns with administrator rights, with no successful login anywhere in the sequence. ^[14] "Combining the two vulnerabilities resulted in full unauthenticated access to the administrative console," CERT Polska wrote in its advisory. ^[15]

The reconstruction was fast because the patch was the only disclosure. CERT Polska had reported some of the underlying bugs through coordinated disclosure and expected to publish alongside MikroTik; the vendor shipped early instead. ^[3] The team diffed the new packages against the old builds line by line. ^[4] The patched login program now rejected usernames beginning with a hyphen or a space, a check it had never run. ^[5] With that and the forum logs, CERT Polska pinned CVE-2026-86060 in about an hour and handed MikroTik a working proof of concept. ^[8]

The same diff carried a sign that attacks were already underway: a new routine that watched for a privileged "ops" account appearing from nowhere and disabled it. ^[6] Administrators had been posting matching entries for days, a failed login for a user named "-2" followed by the creation of a fully privileged "ops" account. ^[7] Logs from the MikroTik forum, Reddit, and direct reports point to one source, 82.192.72.4, repeating the sequence and in several cases pulling diagnostic files off the routers it reached. ^[18]

CERT Polska did the diffing with OpenAI's GPT-5.5-cyber and GPT-5.6-sol, accessed through the company's GTAC program, alongside locally hosted open-weight models. ^[19]