Argument injection in RouterOS's SSH login hands an attacker full-group admin

When an SSH client asks for a shell, RouterOS starts a login helper and hands it a fixed argument pattern that ends with the username and the caller's effective policy mask. ^[3] In a fixed build that username is validated. In older builds it is not, and it arrives straight from the SSH authentication request. ^[3]

The helper also takes an option form. Give it a number and it treats the number as a file descriptor, reads a record from it, and takes the first NUL-separated field as the username and the second as the policy mask. ^[4] The helper's first three descriptors all point at one pseudo-terminal input queue, and an SSH client can write to that queue as channel data. A username of -2 therefore makes the helper read both the username and the mask from bytes the attacker sent. ^[5] Supply the mask 655358 and you have granted yourself the RouterOS full group. ^[6]

So the escalation comes down to two facts: the username is trusted as an argument, and one of its legal values redirects where the helper reads your rights from. ^[5][6]

The "no credentials" description needs a caveat. On its own, CVE-2026-86060 still needs a channel to write those bytes into. In the observed campaign that channel came from CVE-2026-67279, which opens it without authentication. The first bug is what makes the reach unauthenticated, and CVE-2026-86060 supplies only the privilege. ^[7]

A full-policy console outlasts a reboot. It can rewrite routing and firewall rules, read tunnel and VPN keys, and create accounts that survive a restart. ^[8] The operators also copied a diagnostic file out to an external host. The analysis takes that as collection, not a one-off intrusion. ^[9] For an organisation the durable harm is credential disclosure, so treat any secret that transited the device as already exposed. ^[10]

The September 2026 releases carry the fix. ^[2] They do more than add validation: the mechanism now detects and disables a full-group ops account, which the analysis describes as a vendor-side acknowledgement of what happened in practice. ^[12] An unexpected full-group ops account you did not create is evidence of compromise. ^[15]

Scope is every build predating the username validation. ^[11] A scan for os="RouterOS" && service="ssh" returned 9,559 reachable devices, a count of SSH exposure and not of compromise. ^[13] Beyond patching and confirming the version, the guidance is to keep SSH off untrusted networks and to rotate credentials, certificates, VPN keys and pre-shared secrets on affected devices. ^[14]