MikroTrick SSH bypass: '-2' failure, account creation, and login

Arnold Chan@slaz

•updated Sep 23, 2026•0•0•13

Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.