Hackers Are Seizing MikroTik Edge Routers Without Any Login Using the MikroTrick Chain

Hackers are taking over internet-facing MikroTik routers without a password.

CERT Polska confirmed the chain, dubbed MikroTrick, has been hitting SSH-reachable RouterOS boxes since at least 2 September, three days before the public patches landed, GBHackers reported. The attack is on exposed SSH, not every MikroTik on the planet.

The chain pairs CVE-2026-67276, an SSH login bypass, with CVE-2026-86060, a session privilege trick through crafted usernames. Both score 9.2.

Bishop Fox reproduced a related chain on RouterOS 7.x that starts with CVE-2026-67279 instead, then uses the same privilege step. Those first-stage CVE numbers are not the same bug.

On compromised boxes, one observed trick used a scheduler entry to rebuild a privileged account after defenders deleted it. Attacker-added accounts, scripts, and schedulers can survive a reboot even when the login history in memory does not.

Patched builds are 6.49.21, 7.23.4, 7.24.2, or later. The update stops new break-ins. It does not wipe persistence or rotate secrets a hijacked router already leaked. The same no-login pattern is already live on Cisco ISE web management.

Some offers on this page may be paid placements or contain affiliate links.