Advisories

MikroTrick: technical analysis, disclosure process, and the use of LLM agents

We describe the technical details of the MikroTrick chain, which combines the CVE-2026-67279 and CVE-2026-86060 vulnerabilities and, when chained, allowed full takeover of a device without authentication. We explain the mechanics of the attacks observed in the wild, the coordinated disclosure of both vulnerabilities, and the practical role of LLM agents in the RouterOS research.

Read at CERT Polska

Vendor

MikroTik

Product

RouterOS

Exposure class

Edge / VPN / firewall

• CERT Polska (cert.pl)
• CVE-2026-67279 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-86060 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 31
   Research Insikt Group 19d ago

   September 2026 CVE Landscape

   EPSS 1.00 CVE-2026-88771CVE-2026-88772CVE-2026-35273+57 more
2. 65
   CISA alert CISA 25 Sep 2026

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   Exploited CVE-2026-65660CVE-2026-67279 Microsoft MikroTik
3. 16
   Research Check Point Research 14 Sep 2026

   14th September – Threat Intelligence Report

   CVE-2026-72898CVE-2026-85880CVE-2026-81963+4 more
4. 59
   CISA alert CISA 10 Sep 2026

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   Exploited CVE-2026-67277CVE-2026-86060 MikroTik
5. 57
   KEV NVD 5 Sep 2026

   MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the…

   KEV Fix available CVE-2026-86060 MikroTik
6. 69
   KEV NVD 5 Sep 2026

   Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

   KEV · due 28 Sep 2026 (overdue) Fix available CVE-2026-67279 MikroTik
7. 33
   Advisory CERT Polska 5 Sep 2026

   Vulnerabilities in Mikrotik RouterOS software

   CVE-2026-67276CVE-2026-67279CVE-2026-67281+1 more MikroTik