MikroTrick: technical analysis, disclosure process, and the use of LLM agents

On 3 September 2026 MikroTik released patches for multiple RouterOS branches after coordinated disclosure of critical vulnerabilities. The report describes a chained exploit (MikroTrick) combining an SSH rekey/state-machine bug (CVE-2026-67279) and a username-to-file-descriptor parsing flaw (CVE-2026-86060) that together allow unauthenticated attackers to spawn a privileged administrative console; public logs, an observed attacker IP, diagnostic file exfiltration, and inclusion in CISA's KEV catalog indicate active exploitation in the wild, so immediate patching and forensic review are recommended.