AI Helps Uncover MikroTrick Attack Chain in MikroTik RouterOS

MikroTrick chains two RouterOS flaws to bypass authentication and gain admin access. AI helped researchers uncover the attack chain within days.

MikroTik pushed out patches on September 3, 2026 for several RouterOS issues at once, calling it an important security update without saying what it actually fixed. That silence was deliberate, and it didn’t last long. Within days, researchers had reconstructed the whole attack chain from the patch files themselves.

CERT Polska’s Sławomir Rozbicki had reported some of the underlying bugs through coordinated disclosure, and the team expected to publish alongside MikroTik’s release. The vendor shipped early instead. That gap between “patch is out” and “details are public” turned out to be shorter than anyone planned for, and it’s the whole story here.

Once the new RouterOS versions landed, CERT Polska started diffing the packages, comparing patched code against the old builds line by line. They found the login program now rejected usernames starting with a hyphen or a space, something that hadn’t been validated before. They also found a new check that specifically watched for a privileged account named “ops” appearing out of nowhere and automatically disabled it, which told them the vendor already had some idea attacks were happening.

That detail led them to public forums, where administrators had been sharing suspicious log entries for several days. Two lines appeared again and again: a failed login attempt for a user named “-2,” followed by the creation of a fully privileged “ops” account. A failed login that still results in an admin account is not normal. It was a clear sign that something was wrong.

By comparing the patch with those logs, CERT Polska identified a new critical flaw, CVE-2026-86060, in about an hour and gave MikroTik a working proof of concept. Combined with another vulnerability, CVE-2026-67279, the two flaws could give an attacker full administrative access without a password, SSH key, or successful authentication. The researchers called the attack chain MikroTrick, showing how the vulnerabilities could be chained together to abuse the protocol.

Here’s the mechanism, and it’s worth slowing down for. SSH normally won’t let a client touch anything until authentication succeeds, that’s the whole point of the protocol’s layered design. But RouterOS handled something called a rekey, a routine renegotiation of encryption keys mid-session, incorrectly if it happened while authentication was still in progress. Finish that rekey, and the server would skip straight to channel handling as if authentication had already succeeded, even though it never actually did.

That alone doesn’t hand over any privileges. It just gets an attacker into the room. The second bug is what turns “in the room” into “root access.”

When a client starts a session, RouterOS creates a login process and passes it the username and a numeric privilege level as command-line arguments. The problem is that the username is sent to the server before authentication is complete and is not properly sanitized before being passed to the login process.

An attacker can send -2 instead of a normal username. The login process treats -2 as an option that points to file descriptor 2, which is connected to the same terminal channel controlled by the attacker.

This allows the attacker to control the username and privilege information through the SSH connection itself. By setting the privilege mask to 655358, which represents the fully privileged group, the attacker can obtain administrator rights without ever successfully authenticating.

“Combining the two vulnerabilities resulted in full unauthenticated access to the administrative console.” reads the advisory published by CERT Polska. “CVE-2026-67279 allowed an unauthenticated client to create a session channel, while CVE-2026-86060 allowed it to supply login with an attacker-controlled policy mask.”

The tell in the logs, that failed login for user “-2” followed immediately by a new privileged account, matches this exploit chain exactly. CERT Polska is confident MikroTrick was being used in the wild before the patches even existed. Attack logs collected from the MikroTik forum, Reddit, and direct reports to CERT Polska show a consistent source IP, 82.192.72.4, repeatedly attempting this exact sequence, and in several cases succeeding well enough to pull diagnostic files off the compromised routers afterward.

One detail stands out: AI played a major role in the research. CERT Polska used GPT-5.5-cyber and GPT-5.6-sol through OpenAI’s GTAC program, together with locally hosted open-weight models, to build an isolated lab with 40 virtual RouterOS devices covering 24 different versions.

The AI agents helped analyze binaries, test unusual protocol behavior, including out-of-order messages and rekeying before authentication, and monitor public forums for signs that the exploit was spreading. One of those tests led directly to the discovery of CVE-2026-67279.

This is the bigger issue for vendors. Once a patch is released, researchers using similar AI tools can analyze the changes and reconstruct the original vulnerability very quickly. In this case, a public analysis on npratley.net identified the key SSH changes by September 4, less than 24 hours after the patch. By September 5, the “-2” file descriptor trick was already being discussed publicly on Reddit and MikroTik’s forum.

“The speed of LLM-assisted patch analysis is blurring the line between releasing an update and publishing the technical details of a vulnerability. In the case of MikroTrick, the key elements of the flaws were identified publicly within days.” concludes the advisory. “The lower cost of code analysis did not, however, reduce the time required to test and deploy updates or to examine systems for evidence of prior compromise.”

That’s the actual asymmetry worth worrying about, not that attackers move fast, but that patching and forensic cleanup still move at the old, slow pace while reverse engineering has gotten dramatically cheaper. CISA added two of these CVEs to its Known Exploited Vulnerabilities catalog on September 10, with a three day remediation deadline, which tells you how seriously the US government is treating the gap between disclosure and real-world exploitation here.

If you’re running RouterOS anywhere in your infrastructure, particularly on devices exposed to SSH from the internet, patching isn’t optional at this point and it isn’t really about the CVE numbers either. It’s about the fact that the exploit code is already circulating and the identifying log pattern, a rejected login from a user literally named “-2”, is sitting right there for anyone checking their own logs today.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, MikroTik)