Low Severity
CVE-2026-86060
Published: Oct 25, 2026
CVE-2026-67279 + CVE-2026-86060 – MikroTrick MikroTik RouterOS SSH Pre-Auth Takeover (CVSS 9.2) | Red/Blue Team suite. 2 tools: Full Exploit (rekey bypass, fd-2 policy swap, full-admin shell, plant, mass scan, SOCKS5/Tor, stealth) & SafeDetect (banner/version audit, IoC guidance, JSON/CSV/HTML). Use Ethically & Safety only.
# CVE-2026-67279 + CVE-2026-86060 - MikroTrick MikroTik RouterOS SSH Pre-Auth Takeover
[](https://www.python.org/)
[](https://nvd.nist.gov/vuln/detail/CVE-2026-67279)
[](LICENSE)
[](https://github.com/)
> **Pre-Auth SSH Takeover | Policy Mask Swap | Full-Admin Shell | Red-Blue Team Security Research Tool**
---
## [>] Overview
**CVE-2026-67279** and **CVE-2026-86060** form the "MikroTrick" chain — an unauthenticated SSH takeover of **MikroTik RouterOS**. CVE-2026-67279 is a state-machine flaw where a pre-auth rekey request makes the server skip the authentication gate. CVE-2026-86060 is an argument-injection bug in the login helper that treats a `-2` username as "read identity and policy mask from fd 2", letting an attacker write a full-admin policy frame into the PTY.
The chain is actively exploited in the wild since **2026-09-02**. Shadowserver observed **122,500+** internet-exposed RouterOS SSH instances. CISA added CVE-2026-86060 to the KEV catalog on **2026-09-10**.
This repository ships **two separate tools**: a red team tool **`exploit.py`** for authorized red-team operations, and a non-intrusive **`safedetect.py`** for blue teams and security audits.
Both tools are provided for **authorized security research and educational purposes only.**
---
## [>] Features
| Feature | Description |
|---------|-------------|
| [+] **Pre-Auth Rekey Bypass** | CVE-2026-67279 — rekey before auth drops the server-side authentication gate |
| [+] **FD-2 Policy Swap** | CVE-2026-86060 — writes identity + full policy mask into the PTY, console comes up as admin |
| [+] **Full-Admin Shell** | Interactive RouterOS console without credentials |
| [+] **Account Plant** | C