Two lines in a router log told the story. A failed SSH login for a user called "-2", and then, in the same session, a brand new administrator account named "ops". MikroTik owners had been pasting that pair into forum threads since early September without knowing what they were looking at. CERT Polska has now published the answer, and it is not a weak password: those two lines are the fingerprint of a chain that hands an attacker complete control of a RouterOS device with no password, no SSH key and no completed login at all.
The Polish national CERT calls the chain MikroTrick, and its researcher Sławomir Rozbicki set out how it works in a technical analysis published on 22 September. MikroTik shipped the fixes on 3 September across RouterOS 7.25beta3, 7.24.2, 7.23.4 and 6.49.21, deliberately withholding the details so administrators could update first. We covered the attacks themselves on 6 September. What is new is the mechanism, and a warning about how little time that silence now buys.
A handshake that forgets to check who you are
The first flaw, CVE-2026-67279 (CVSS 6.9), lives in a corner of SSH almost nobody thinks about. Either side of a connection can ask to renegotiate its encryption keys mid-session, a routine operation called a rekey. Vulnerable RouterOS builds handled a rekey requested during login incorrectly: when it finished, the server jumped straight to serving the client a session instead of resuming the login it had interrupted. It never sent the success message that normally marks an authenticated user. On its own the bug grants no identity and no privileges. It simply opens the door to the next one.
Why a username that starts with a hyphen matters
That next one is CVE-2026-86060, rated 9.2. Once a session channel exists, RouterOS starts a login helper at /nova/bin/login and passes it the username the client supplied, unvalidated, as a command-line argument. A value beginning with a hyphen is read as an option rather than a name. The helper understands a "-N" form in which N identifies a file descriptor to read a username and a privilege mask from. Supplying "-2" points it at the pseudoterminal the attacker is already holding, so the attacker simply sends the privilege level they would like. That is where the failed login for "-2" in those forum logs comes from, and the patched builds now reject any username beginning with a hyphen or a space.
The patch was the disclosure
Rozbicki's broader point is about timing. A public teardown of the patched packages appeared at 03:22 UTC on 4 September, roughly a day after release, written by an author who described the work as AI assisted. By 5 September the "-2" trick had been publicly tied to a file descriptor, and independent researchers reported reproducing unauthenticated access without publishing a full exploit. CERT Polska began publishing its CVE records that evening, judging that confidentiality was by then costing defenders more than it cost attackers. The team used the same class of tooling in its own lab, running LLM agents across 40 virtual RouterOS machines and 24 releases to test protocol state machines for exactly this sort of invalid transition. Cheaper code analysis, it notes, has not made testing and deploying a router update any faster.
Update RouterOS, then go looking for an "ops" account
Install 7.25beta3, 7.24.2, 7.23.4 or 6.49.21. CISA added CVE-2026-86060 and CVE-2026-67277 to its Known Exploited Vulnerabilities catalog on 10 September with a three-day federal remediation deadline, so patched or not, treat an exposed device as suspect. Patched builds disable a privileged "ops" account at startup and raise a flag, but an already-compromised router needs a manual review of its user list, its scheduler and its fetch history. Reported activity came from 82[.]192[.]72[.]4, and several administrators found diagnostic RIF files created and then uploaded to that address. One correction worth carrying forward: CERT Polska says CVE-2026-67276, which several write-ups folded into MikroTrick, is a separate and far more conditional bug that is not part of the chain.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.