CVE-2026-86060: Administrative Privilege Escalation via SSH Argument Delimiter Injection in MikroTik RouterOS ("MikroTrick")

HERMES

HERMES THREAT SCORE & PERIMETER RISK

Target: MikroTik RouterOS - SSH Authentication Subsystem (TCP Port 22)

Confidence: 99%

94 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 19 / 20

Weaponization 19 / 20

Exposure 20 / 20

Prevalence 18 / 20

Impact 19 / 20

Exploit Maturity 19 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-86060 at 9.2 (Critical) and CVSS v4.0 at 9.2 (Critical). The Hermes Threat Score assigns it 94 (CRITICAL). The 'MikroTrick' exploit chain combines an RSA public key authentication bypass (CVE-2026-67276) with this argument injection flaw (CVE-2026-86060). On internet-exposed routers, an unauthenticated remote attacker instantly achieves full administrative access (policy=all). Edge routers are immediately repurposed as covert SOCKS5 proxies, network wiretaps, or lateral pivots to compromise internal enterprise networks.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-86060: MikroTik RouterOS SSH Argument Delimiter Privilege EscalationVULNERABILITY

Connected Nodes: 3

Active Relationships (Outgoing)

→ affectsPRODUCTMikroTik RouterOS

99% VERY_HIGH

Network operating system developed by MikroTik providing routing, firewall, VPN, and bandwidth-testing services on edge and core network devices.

🔍 Why is this related? (Evidence & Provenance)

“Argument delimiter injection in SSH login path escalates session privileges to full admin on RouterOS.”

Supporting Verified Evidence:

• [cert_confirmation]CISA and CERT Polska confirmed active in-the-wild exploitation of RouterOS CVE-2026-86060 in the MikroTrick attack chain. — Source: CISA / CERT Polska: CISA KEV & CERT Polska Advisory: MikroTrick RouterOS Exploitation (CVE-2026-86060, CVE-2026-67276) (Reliability: VERY_HIGH)

→ used_inCAMPAIGNOperation MikroTrick 2026

98% VERY_HIGH

Mass exploitation campaign targeting internet-exposed MikroTik RouterOS devices via SSH authentication bypass and argument delimiter privilege escalation.

🔍 Why is this related? (Evidence & Provenance)

“Actively exploited in the wild as the second stage of the MikroTrick campaign.”

Supporting Verified Evidence:

• [cert_confirmation]CISA and CERT Polska confirmed active in-the-wild exploitation of RouterOS CVE-2026-86060 in the MikroTrick attack chain. — Source: CISA / CERT Polska: CISA KEV & CERT Polska Advisory: MikroTrick RouterOS Exploitation (CVE-2026-86060, CVE-2026-67276) (Reliability: VERY_HIGH)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CISA KEV Alert: Active In-the-Wild Exploitation (BOD 26-04 Directive)

CVSS v3.1: 9.2 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CVSS v4.0: 9.2 Critical (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) / CWE-88: Improper Neutralization of Argument Delimiters in a Command (Argument Injection). Added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on September 10, 2026 under Binding Operational Directive BOD 26-04. Affects MikroTik RouterOS v6 Long-term < 6.49.21, v7 Long-term < 7.23.4, and v7 Stable < 7.24.2. Fixed in 6.49.21, 7.23.4, 7.24.2, and 7.25beta3.

Executive Summary

On September 3, 2026, Latvian vendor MikroTik issued emergency security updates resolving a critical attack chain named ‘MikroTrick’ by researchers at CERT Polska. Tracked as CVE-2026-67276 and CVE-2026-86060, this chain enables unauthenticated remote threat actors to take absolute administrative ownership of any RouterOS edge device exposing its SSH management port (TCP 22) to the internet.

CVE-2026-86060 represents the privilege escalation pillar of this exploit chain. During SSH session initialization, the RouterOS login process passes the client-supplied username to an internal session handler without sanitizing leading hyphens. By providing a crafted username starting with a delimiter (such as -2), an attacker hijacks the internal argument parser, coercing the subsystem into assigning the maximum policy bitmask (policy=read,write,policy,test,password,sniff,...). Coupled with the cryptographic RSA bypass in CVE-2026-67276, this enables complete, weaponized remote takeover.

---

1. Technical Context & Affected Software Matrix

MikroTik RouterOS is one of the most ubiquitously deployed network operating systems worldwide, powering enterprise boundary routers, core ISP gateways (WISP/FTTH), data center switches, and industrial remote sites.

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-86060	International tracking reference & CISA KEV entry
Chain Designation	MikroTrick (paired with CVE-2026-67276)	Named and documented by CERT Polska
Vendor / Platform	MikroTik / RouterOS	Network operating system on RouterBOARD & x86 hardware
Vulnerable Component	SSH daemon & internal session policy parser	Command argument parser during login sequence
Network Vector	Port 22/TCP (RouterOS SSH service)	Management CLI interface
Privileges Acquired	Full Administrator (group=full, policy=all)	Unrestricted configuration, firmware, and routing control
Affected Versions (v6)	Branch Long-term v6 < 6.49.21	Large legacy enterprise & industrial fleet
Affected Versions (v7)	Branch Long-term v7 < 7.23.4; Branch Stable < 7.24.2	Modern enterprise perimeter deployments
Patched Versions	6.49.21 (v6 Long-term), 7.23.4 (v7 Long-term), 7.24.2 (v7 Stable), 7.25beta3	Official security releases from September 3, 2026
CISA KEV Status	Added on September 10, 2026 (BOD 26-04)	Confirmed active exploitation in the wild

The Critical Role of RouterOS in Enterprise Architecture

In an enterprise or critical infrastructure environment, a MikroTik router acts as the nexus of all communication:

1. Perimeter Default Gateway: Handles all transit traffic to the internet, stateful firewalling (conntrack), NAT, and inter-VLAN routing.
2. VPN Concentrator: Terminates WireGuard, IPsec IKEv2, SSTP, and OpenVPN tunnels linking corporate headquarters, cloud VPCs, remote branches, and remote workers.
3. Core Infrastructure Services: Operates DNS caching, DHCP pools, BGP peerings, and OSPF backbones.
4. Native Packet Interception: Features a built-in packet sniffer (/tool sniffer) capable of streaming raw traffic over TZSP (TaZmen Sniffer Protocol) to arbitrary remote collectors in real time.

Breaching a RouterOS edge router grants attackers an immediate, persistent Man-in-the-Middle (MitM) vantage point across all inbound and outbound organizational data.

---

2. In-Depth Technical Decomposition: Anatomy of the MikroTrick Chain

The “MikroTrick” chain functions through the sequential exploitation of two distinct software vulnerabilities:

+---------------------------------------------------------------------------------------------------------+
|                                  ANATOMY OF THE MIKROTRICK EXPLOIT CHAIN                                |
+---------------------------------------------------------------------------------------------------------+

  [Attacker Machine]                                                    [Target MikroTik RouterOS]
   IP: 198.51.100.42                                                     IP: 203.0.113.1 (WAN Interface)
                                                                         Port TCP 22 (Exposed SSH)
          │                                                                      │
   [1]    │───── SSH Transport Handshake (KexDH, Cipher, MAC) ──────────────────>│
          │                                                                      │
   [2]    │───── SSH Authentication Attempt (CVE-2026-67276): ───────────────────>│ Flawed RSA Verification:
          │      Sends public key modulus without holding private key            │ RouterOS accepts auth
          │                                                                      │ without verifying private signature!
          │                                                                      │
   [3]    │───── Username Argument Injection (CVE-2026-86060): ──────────────────>│ Passes crafted username to
          │      Username payload: "-2"                                          │ internal session worker.
          │                                                                      │
   [4]    │                                                                      │ Internal CLI Argument Parser:
          │                                                                      │ Leading "-" interpreted as
          │                                                                      │ command-line option switch!
          │                                                                      │ Overwrites session policy mask:
          │                                                                      │ policy = 0xFFFFFFFF (FULL ADMIN)
          │                                                                      │
   [5]    │<════ Interactive CLI Shell with Full Policy Granted ═════════════════│
          │                                                                      │
   [6]    │───── Create Backdoor: /user add name=ops group=full ─────────────────>│ Administrative persistence
   [7]    │───── Enable Proxy: /ip socks set enabled=yes port=1080 ──────────────>│ Router weaponized as ORB relay
   [8]    │───── Packet Sniff: /tool sniffer start streaming-server=... ─────────>│ Passive credential exfiltration

Stage 1: The SSH Authentication Bypass (CVE-2026-67276)

In vulnerable RouterOS builds, the SSH daemon’s implementation of public key verification (ssh-rsa) contains a logic failure:

• When a client issues an SSH_MSG_USERAUTH_REQUEST with public key data, RouterOS improperly validates the relationship between the client’s public key modulus and the signature generated over the session ID.
• An attacker can present a known public key without possessing the corresponding private key, and the authentication state machine transitions to SUCCESS.

Stage 2: Argument Delimiter Injection (CVE-2026-86060)

With the authentication barrier broken, the attacker’s session would normally inherit the permissions of the targeted user. CVE-2026-86060 shatters this boundary:

1. Unsanitized Parameter Passing: The username string received over SSH is forwarded directly to the RouterOS internal session management binary.
2. Command Option Injection (CWE-88): Because the binary uses standard getopt-style command-line parsing, a username beginning with a hyphen (-) is treated as a command flag rather than a positional operand.
3. Policy Bitmask Overwrite: Specific numerical or character flags (such as -2) toggle internal execution modes, forcing the process to assign the session a permission bitmask of all ones (0xFFFFFFFF), equivalent to group=full (read, write, policy, test, password, sniff, sensitive, reboot, romon).
4. Outcome: The attacker drops directly into an unconstrained administrative CLI shell.

---

3. Threat Intelligence, Threat Actors & Active Exploitation

Operational Timeline

• Late August 2026: Honeypots in Eastern Europe detect high-frequency scanning targeting port 22 on MikroTik netblocks using malformed SSH handshakes.
• September 2, 2026: CERT Polska identifies and confirms the two-stage “MikroTrick” chain in live attacks and notifies MikroTik.
• September 3, 2026: MikroTik releases emergency security updates across all active release channels (6.49.21, 7.23.4, 7.24.2, 7.25beta3).
• September 10, 2026: CISA adds CVE-2026-86060 and CVE-2026-67277 to the Known Exploited Vulnerabilities (KEV) Catalog, requiring federal compliance under BOD 26-04 by October 1, 2026.

Threat Actor Profiling & Post-Exploitation TTPs

Telemetry reveals three dominant adversary use cases:

1. Operational Relay Box (ORB) & Residential Proxy Networks:
   • Attackers create hidden administrative accounts (e.g., ops, backup_adm) and enable the built-in SOCKS5 proxy (/ip socks set enabled=yes).
   • The compromised router becomes an anonymization hop used to mask financial fraud, credential stuffing, and ransomware deployment.
2. High-Throughput DDoS Botnets (Next-Gen Meris):
   • Leverages the robust hardware acceleration (10G/25G SFP+) of MikroTik CCR (Cloud Core Router) devices.
   • Attackers deploy scheduled tasks (/system scheduler) executing recurring scripts to launch massive volumetric DNS and UDP reflection attacks.
3. Nation-State APT Pre-Positioning:
   • Intelligence-driven threat actors establish persistent covert footholds within critical infrastructure, government agencies, and telecom providers.
   • Attackers deploy /tool sniffer to siphon unencrypted traffic and leverage RouterOS to pivot laterally into internal Active Directory domains and OT networks.

---

4. Doctrinal Security Principle: “What happens if this vulnerability is exploited in an enterprise?”

If CVE-2026-86060 is successfully exploited against an enterprise router, the following catastrophic sequence unfolds:

1. Perimeter Boundary Collapse

The enterprise perimeter ceases to exist. The adversary can rewrite firewall rules (/ip firewall filter), disable NAT protections, and establish port-forwarding rules (dst-nat) exposing internal domain controllers, hypervisors, and industrial PLCs directly to the public internet.

2. Full-Fidelity Traffic Interception (MitM)

With sniff privileges, the adversary activates RouterOS’s native packet capture engine, mirroring all enterprise traffic via TZSP to a remote server. Unencrypted credentials, sensitive business emails, and API keys are harvested continuously without degrading line rates or alerting users.

3. DNS Poisoning & AitM Phishing

Attackers can inject malicious entries into the RouterOS DNS cache (/ip dns static) or overwrite upstream DNS forwarders. Enterprise workstations resolving internal or external services (e.g., Okta, Microsoft 365, internal ERP) are silently redirected to adversary-controlled Adversary-in-the-Middle (AitM) reverse proxies to harvest MFA session cookies.

4. Direct Lateral Infiltration

Because the perimeter router connects directly to internal user VLANs, DMZ segments, and management subnets, the attacker bypasses all external firewall filtering. They can launch SSH/RDP brute-force campaigns against internal hosts or establish persistent WireGuard/EoIP tunnels straight into the corporate core.

5. Resilient Firmware-Level Persistence

Threat actors configure scheduled scripts (/system scheduler), alter backup files, and enable RoMON (Router Management Overlay Network) to preserve access across WAN IP changes and standard administrative reboots.

---

5. Threat Hunting, Detection & Forensic Investigation

Identifying Compromise (The “Flagged” Indicator)

Modern RouterOS releases feature built-in tampering detection. If the operating system detects anomalous binary modification or unauthorized policy table manipulation, it marks the system with a Flagged state in system logs and telemetry.

Run the following forensic inspection commands via the CLI immediately:

# 1. Inspect critical log events and security warnings
/log print where topics~"critical" or topics~"error" or topics~"warning"

# 2. Audit all user accounts and assigned policy groups
/user print detail
/user group print detail

# 3. Detect unauthorized scripts and scheduled automation
/system script print detail
/system scheduler print detail

# 4. Check for unauthorized proxy services
/ip service print
/ip socks print
/ip socks access print

# 5. Check active network packet sniffers
/tool sniffer print

# 6. Audit port-forwarding and destination NAT rules
/ip firewall nat print detail where action="dst-nat"

# 7. Check local flash storage for suspicious payload files
/file print detail

Indicators of Compromise (IOCs)

Indicator Type	Value / Signature	Interpretation
Suspicious Users	-2, ops, support_tech, adm_backup	Backdoor accounts created via exploit
Network Service	Port TCP 1080 active on /ip socks	Router weaponized as SOCKS proxy
Scheduled Tasks	Recurring jobs triggering scripts every 5–15 min	Persistent beaconing or DDoS scheduler
Suspicious Files	*.rsc, *.auto.rsc in flash root	Dropped configuration payloads
System Log	user -2 logged in via ssh, Flagged banner	Definitive proof of MikroTrick compromise

---

Sigma Rule: MikroTik RouterOS Suspicious SSH Login & Privilege Escalation

title: MikroTik RouterOS MikroTrick Exploitation Detection (CVE-2026-86060)
id: 86060-mikrotik-ssh-arg-injection
status: experimental
description: Detects SSH login attempts targeting MikroTik RouterOS using crafted usernames with leading hyphens or subsequent unauthorized administrative account creation.
author: Hermes Codex Cyber Threat Intelligence
date: 2026-09-11
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060
  - https://cert.pl
tags:
  - attack.initial_access
  - attack.privilege_escalation
  - attack.t1190
  - attack.t1068
logsource:
  product: routeros
  service: system_log
detection:
  selection_ssh_login:
    topics|contains: 'ssh'
    message|contains:
      - 'logged in'
      - 'login failure'
  selection_suspicious_user:
    message|contains:
      - 'user -'
      - 'user -2'
      - 'user --'
      - 'user ops'
  selection_policy_tamper:
    topics|contains: 'account'
    message|contains:
      - 'user added'
      - 'group changed'
      - 'group=full'
  condition: selection_ssh_login and (selection_suspicious_user or selection_policy_tamper)
falsepositives:
  - Legitimate administrators (extremely unlikely to use leading hyphens in usernames)
level: critical

---

YARA Rule: MikroTik RouterOS Backdoor Scripts

rule MikroTik_RouterOS_MikroTrick_Backdoor_Script {
    meta:
        description = "Detects persistence and configuration scripts deployed in MikroTrick CVE-2026-86060 intrusions"
        author = "Hermes Codex CTI"
        date = "2026-09-11"
        reference = "CVE-2026-86060"
        severity = "HIGH"
    strings:
        $cmd_user = "/user add name=" ascii wide nocase
        $cmd_group = "group=full" ascii wide nocase
        $cmd_socks = "/ip socks set enabled=yes" ascii wide nocase
        $cmd_sched = "/system scheduler add" ascii wide nocase
        $cmd_sniff = "/tool sniffer set streaming-server=" ascii wide nocase
        $target_user1 = "name=\"ops\"" ascii wide nocase
        $target_user2 = "name=\"-2\"" ascii wide nocase
    condition:
        ( ($cmd_user and $cmd_group) and ($target_user1 or $target_user2 or $cmd_socks or $cmd_sched or $cmd_sniff) )
}

---

Suricata / Snort Rule: SSH Argument Delimiter Injection

# Detects SSH authentication attempt with username starting with a hyphen (CVE-2026-86060)
alert tcp any any -> any 22 (msg:"HERMES CODEX - MikroTik RouterOS SSH Argument Injection Probe (CVE-2026-86060)"; flow:to_server,established; content:"SSH-2.0-"; depth:8; content:"|00 00 00 02 2d|"; distance:0; reference:cve,2026-86060; reference:url,cisa.gov/known-exploited-vulnerabilities-catalog; classtype:attempted-admin; sid:202686060; rev:1;)

---

6. MITRE ATT&CK Mapping

Tactical Phase	MITRE ID	Technique / Sub-technique	Role in MikroTrick Campaign
Initial Access	T1190	Exploit Public-Facing Application	Exploitation of exposed SSH service on TCP port 22
Privilege Escalation	T1068	Exploitation for Privilege Escalation	Argument injection coercing session policy to policy=all
Defense Evasion	T1562.004	Impair Defenses: Disable or Modify System Firewall	Disabling perimeter firewall and conntrack filters
Persistence	T1136.001	Create Account: Local Account	Creation of covert admin accounts (ops, -2)
Persistence	T1053.005	Scheduled Task/Job: Scheduled Task	Persistence via /system scheduler recurring tasks
Command and Control	T1090.002	Proxy: External Proxy	Enabling /ip socks to establish an ORB node
Collection	T1040	Network Sniffing	Using /tool sniffer to stream raw enterprise transit traffic
Lateral Movement	T1021.004	Remote Services: SSH	Pivoting from router into internal servers

---

7. Comprehensive Remediation & Hardening Guide

1. Immediate Firmware Upgrade

Upgrade RouterOS to one of the patched releases issued on September 3, 2026:

• v6 Long-term Branch: Version 6.49.21 (or later)
• v7 Long-term Branch: Version 7.23.4 (or later)
• v7 Stable Branch: Version 7.24.2 (or later)
• v7 Testing Branch: Version 7.25beta3 (or later)

# Download and install via RouterOS CLI
/system package update set channel=stable
/system package update check-for-updates
/system package update download
/system reboot

[!IMPORTANT] Reboot Required: YES. Updating packages and loading the patched kernel strictly requires a system reboot (/system reboot).

2. Immediate Workarounds & Defensive Hardening

If an immediate upgrade is impossible within the operational window:

1. Disable SSH on exposed interfaces:

   /ip service set ssh disabled=yes

2. Restrict SSH to trusted management subnets only:

   /ip service set ssh address=10.100.0.0/24,192.168.1.50/32 disabled=no

3. Enforce VPN-Only Management (WireGuard): Never expose administrative interfaces (SSH 22, WinBox 8291, WebFig 80/443) to the public internet. Use dedicated WireGuard or IPsec tunnels for out-of-band administration.

3. Compromised Device Recovery (“Flagged” Status)

If a device shows a Flagged status, unknown accounts, or suspicious scripts, patching alone is insufficient because the adversary may have modified internal flash structures.

1. Export configuration for offline forensic review:

   /export file=audit_config.rsc

2. Complete Re-flash via MikroTik Netinstall: Netinstall is the authoritative recovery utility. Connect via Ethernet, hold the RouterBOARD Reset button during boot, and rewrite the flash storage partition completely with a clean image.
3. Comprehensive Secret & Key Rotation:
   • Regenerate SSH host keys: /ip ssh regenerate-host-key
   • Rotate all administrative passwords.
   • Revoke and reissue all SSH public keys (/user ssh-keys).
   • Rotate all WireGuard private keys and IPsec pre-shared keys.

---

8. Related Threat Intelligence & References

CVE-2026-67277: MikroTik RouterOS Kernel Memory Leak & DoS Bandwidth-Test service authentication bypass and unsigned integer underflow on port 2000.

CVE-2026-20079: Cisco Secure FMC Authentication Bypass to Root RCE Analysis of perimeter network management plane authentication bypass and root takeover.

Threat Hunting: Lateral Movement SMB vs RDP Detecting lateral movement across corporate segments following perimeter router infiltration.

Active Directory Lateral Movement Playbook Tactical incident response procedures when edge network gateways are breached.