This briefing was produced by AI from the linked sources and is scheduled for human editorial review within 24 hours. Read the sources directly for material decisions.
EVIDENCE — CISA added CVE-2026-67279 to its Known Exploited Vulnerabilities catalog on 25 September 2026 and says it can be chained with CVE-2026-86060 for unauthenticated exploitation. CERT Polska separately confirms that the MikroTrick chain is being used against internet-accessible RouterOS SSH services to take full control of devices, with successful activity observed since at least 2 September. CISA set a 28 September remediation deadline for covered federal systems; the catalog lists ransomware use as unknown.
THE SSH STATE MACHINE ADVANCED WITHOUT A USER — CVE-2026-67279 lets a client request rekeying before attempting authentication, yet affected RouterOS builds proceed into the SSH connection protocol. The unauthenticated client can open a session channel and submit an exec request, allowing creation, overwrite, or reconstruction of files in RouterOS's managed file namespace. CVE-2026-86060 then abuses a crafted username to alter the trusted policy mask and produce a session with full RouterOS administrative privileges.
THE ROUTER MAY LOOK NORMAL AFTER TAKEOVER — CERT Polska observed the chain creating a highly privileged user named ops and recorded the log pattern "login failure for user -2" followed by a user being added through ssh:-2. Its confirmed successful attacks came from 82.192.72.4, while 103.102.31.18 was used for attempts. Patched RouterOS releases can mark suspicious configurations as Flagged and disable selected entries, but both CERT Polska and MikroTik warn that the absence of this marker does not prove a device is clean.
AI ACCELERATED DISCOVERY, NOT PROOF — CERT Polska says GPT-5.5-cyber and GPT-5.6-sol helped automate version comparison, protocol-state modeling, binary analysis, laboratory resets, and confirmation scripts. Researchers still required clean-machine reproduction, negative controls, repeated testing, and human impact assessment for every hypothesis. That distinction matters: agentic security research can widen coverage, but the defensible result is the verified trace from protocol mistake to observable device compromise.
WHAT TO CHECK — Upgrade affected routers to RouterOS 7.24.2, 7.23.4, or 6.49.21 as appropriate, or a later supported release, then confirm the running version. Remove SSH, WebFig, and bandwidth-test exposure from public networks and require access through a trusted management network or WireGuard. Preserve logs and configuration before resetting a suspicious router; check /system/device-mode/print, Flagged status, the two IP addresses, user ops, ssh:-2 log entries, and unknown users, scripts, scheduler tasks, proxies, or tunnels. If compromise is possible, isolate the device, rebuild from factory state and a verified configuration rather than restoring a full suspect backup, then rotate every password, key, and secret it could access.