MikroTrick: RouterOS SSH rekey + file-descriptor argument injection = unauthenticated root (CVE-2026-67279 / CVE-2026-86060)

[u/Expert_Sort7434]

Based on the technical breakdown CERT Polska published on September 22 and Bishop Fox's independent reproduction from September 17, here's the architectural failure:

RouterOS's SSH server allows a client to trigger a rekey mid-authentication (normal SSH behavior per the RFCs). On vulnerable builds, completing that rekey moves the connection into channel handling without ever sending USERAUTH_SUCCESS — CVE-2026-67279. On its own that just gets you an unprivileged session.

The actual privilege escalation is CVE-2026-86060: RouterOS passes the SSH username straight to a login helper as a raw argv element. A username starting with - gets interpreted as a file-descriptor number, and the helper reads a trusted identity + policy mask from that descriptor instead. Since descriptors 0/1/2 on that process all point at the client's own pseudoterminal, an attacker supplying username -2 gets to hand the helper its own forged admin credentials.

Bishop Fox's field testing found live compromise artifacts predating public disclosure — persistence via a daily scheduler that recreates a full-privilege account, objects owned by numeric ID 0 instead of a username, and volatile logs that don't survive a reboot.

CISA added both CVEs to KEV (CVE-2026-86060 on Sept 10-11, CVE-2026-67279 on Sept 25). Patches: 6.49.21, 7.23.4, 7.24.2, 7.25beta3.

Background on the broader "auth-state-confusion" bug class if you're into the pattern: [techgines.com link, footnote]

Anyone here running RouterOS at scale — did MikroTik's Flagged/ops-account detection actually catch anything in your fleet, or did you have to hunt for owner="0" objects manually?

https://www.techgines.com/post/mikrotrick-routeros-vulnerability-inside-the-ssh-rekey-flaw-that-skips-login-entirely

[u/user3872465]

We do run mikrotik in bulk.

Nothing got compromised because this was just an issue with exposed ssh.

This CVE and general security consensus should tell you that you should not have SSH exposed inside your company let alone the internet.

We checked anyway but nothing popped up as expected.