MikroTrick Chain Lets Attackers Control MikroTik Routers Without Credentials
Two linked vulnerabilities in MikroTik RouterOS allow attackers to gain full administrative access without needing passwords or SSH keys, identified by CERT Polska as CVE-2026-67279 and CVE-2026-86060 in the MikroTrick exploit chain.
Why it matters
This exploit enables attackers to fully take over exposed MikroTik routers, significantly increasing the risk to network integrity and security.
SOC impact
Defenders must prioritize identifying affected MikroTik router instances and monitor for unusual administrative activity that may indicate exploitation of the MikroTrick chain. Incident response efforts should focus on detecting attempts to leverage these linked vulnerabilities to gain unauthorized router access.
Recommended actions
- Identify assets running vulnerable MikroTik RouterOS versions
- Review administrator access logs for suspicious activities
- Monitor network telemetry for unusual router management actions
- Confirm deployment of security controls on MikroTik devices
- Investigate alerts related to CVE-2026-67279 and CVE-2026-86060 exploit attempts
Executive Summary
CERT Polska has disclosed a chain of two linked vulnerabilities, CVE-2026-67279 and CVE-2026-86060, collectively named MikroTrick, that allow attackers to gain full administrative control over MikroTik routers without requiring passwords or SSH keys. This exploit targets exposed MikroTik RouterOS devices, potentially compromising critical network infrastructure. For defenders, understanding the specific vulnerabilities and monitoring affected devices for unauthorized access attempts is essential to reduce the risk from this exploit chain. Operational teams should focus on identifying vulnerable routers and closely observe authentication and administrative logs to detect any exploitation activity.
SOC Impact
Defenders must prioritize identifying affected MikroTik router instances and monitor for unusual administrative activity that may indicate exploitation of the MikroTrick chain. Incident response efforts should focus on detecting attempts to leverage these linked vulnerabilities to gain unauthorized router access.
Router and Authentication Validation
- Identify assets running vulnerable MikroTik RouterOS versions
- Review administrator access logs for suspicious activities
- Monitor network telemetry for unusual router management actions
- Confirm deployment of security controls on MikroTik devices
- Investigate alerts related to CVE-2026-67279 and CVE-2026-86060 exploit attempts
Why It Matters
This exploit enables attackers to fully take over exposed MikroTik routers, significantly increasing the risk to network integrity and security.