Name given by CERT Polska to an exploit chain against MikroTik RouterOS that combines an SSH authentication bypass with a session privilege escalation.
CERT Polska disclosed MikroTrick, a chain of two RouterOS flaws that gives unauthenticated admin on routers whose SSH faces the internet. Attacks were already under way at disclosure. Reachable SSH is the one condition the chain needs.
Reality
Federal agencies now have three separate patch deadlines inside twelve days. The lowest-scoring pair of the five flaws added to KEV is the one with a documented 24-day intrusion campaign behind it.
Reality
CVE-2026-86060, the privilege half of the MikroTrick chain CERT Polska analysed, lets an SSH client set its own policy mask and take RouterOS full-group admin. The September 2026 releases fix it, and a scan found 9,559 devices reachable over SSH.
Reality
CERT Polska dated successful attacks to at least September 2 and published its warning on September 5, so operators who deferred the RouterOS update have three days of configuration changes to read as well as a patch to install.
Perspective Coverage
8 publishersReality
MikroTik published RouterOS fixes in four branches with no CVE and no technical detail. The same upgrade runs a compromise check and writes a critical log entry marking the device Flagged.
Perspective Coverage
3 publishersReality
CERT Polska rebuilt the MikroTrick attack chain from MikroTik's unlabeled September 3 patch and had a working exploit for CVE-2026-86060 in about an hour. The fix quietly disables a rogue "ops" account, evidence the chain was already exploited in the wild.
Reality
CERT Polska confirmed exploitation of the MikroTrick chain on September 5, and the two bugs need no password and no private key, only a reachable SSH service, so the firewall rule scopes the risk before any build audit can.
Reality
Two RouterOS flaws published to NVD on 2026-09-05 both sit in code that runs before a session has proven who it is. An upgrade closes them. Which management services answer from the internet is still an open question.
Reality