> TritonInfoSec News
Home / Sep 24, 2026 / Story
0
#6 The Hacker News general September 23, 2026 at 16:06 UTC

MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key

By [email protected] (The Hacker News)

AI Summary

CERT Polska detailed 'MikroTrick,' a chained exploit combining an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in RouterOS login (CVE-2026-86060), enabling full administrative takeover of internet-exposed MikroTik routers without credentials or SSH keys. Attack logs confirm real-world exploitation is already occurring. Network defenders managing MikroTik RouterOS devices should patch immediately given the no-auth, full-control impact.

Read full article → https://thehackernews.com/2026/09/mikrotrick-chain…

Relevance score: 85.0/100

# More from September 24

  1. 1
    F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers The Hacker News
  2. 2
    ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants The Hacker News
  3. 3
    Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks The Hacker News
  4. 4
    Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware The Hacker News
  5. 5
    Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises The Hacker News
  6. 7
    Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape The Hacker News
  7. 8
    Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers BleepingComputer
  8. 9
    Check Point warns of hackers exploiting Security Gateway VPN RCE flaw BleepingComputer
  9. 10
    Arista patches actively exploited VeloCloud Orchestrator zero-day BleepingComputer