MikroTik's login program takes its privilege level from the attacker's terminal

SSH has an order. Encrypted connection first, then authentication, then a session in which the client can run commands, with the server sending SSH_MSG_USERAUTH_SUCCESS to say the second step passed ^[6]. CVE-2026-67279 drops that confirmation: a client that begins a key renegotiation during the authentication step lands in the command phase as soon as the renegotiation finishes ^[7]. On its own the bug is not an authenticated session and grants no privileges, but it puts an unauthenticated client at a stage that should require a completed login ^[8].

The second bug converts that position into privilege. RouterOS starts /nova/bin/login with the username and a privilege level passed in as command-line arguments by the SSH daemon, and the username is not checked first, so a value beginning with a hyphen is read as an option ^[9]. The attacker sends -2. The login program reads its identity and privilege level from file descriptor 2, which is the terminal the SSH session created ^[10]. Over the SSH channel the attacker has already written a chosen username and the full-administrator privilege value to that terminal, and login accepts both and opens a fully privileged console ^[11].

Logs showing a failed login for user -2 were on the MikroTik forum as early as September 2 ^[12], one day before the fixed builds, which puts the patch on September 3 ^[3][4]. CERT Polska's public warning came on September 5; it confirmed that attackers were taking over devices with SSH reachable from public networks and did not say which two flaws formed the chain ^[5]. CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10, eight days after the first logged attempt ^[17][22].

On the one device with a published diagnostic, the sequence ran rejected authentication for -2, a forced renegotiation, a jump to the channel phase, and an exec request creating a user called ops with full privileges, and the SSH process crashed before the command completed ^[13]. In some incidents CERT Polska found a diagnostic file created and then data transferred to an attacker IP address, which it says strongly suggests configuration data was copied to the attacker's infrastructure ^[15].

Reachability is the limit on all of this. MikroTik says its default home configuration does not expose SSH to the internet, and the higher risk sits with administrators who changed their firewall rules or manage devices over SSH from untrusted networks ^[18]. No authoritative count of compromised devices has been published ^[19]. For a device in that set that was reachable before September 3, the update closes the chain and leaves in place anything done beforehand ^[20]. The Flagged check, run with /system/device-mode/print, detects only selected traces of compromise, and its absence does not prove the device is safe ^[20][21].