MikroTik RouterOS administrators are being urged to update immediately after CERT Polska confirmed that two vulnerabilities are being actively exploited against internet-exposed devices.
The vulnerabilities, tracked as CVE-2026-67276 and CVE-2026-86060, can be chained together to bypass SSH authentication and escalate privileges to full administrative access.
CERT Polska has named the attack chain “MikroTrick” and confirmed that attackers are already using it against RouterOS devices whose SSH service is accessible from public networks.
What happened?
On September 5, 2026, CERT Polska disclosed six vulnerabilities affecting different parts of MikroTik RouterOS.
Two of them are particularly serious:
- CVE-2026-67276 — SSH authentication bypass, CVSS 9.2
- CVE-2026-86060 — SSH privilege escalation, CVSS 9.2
When combined, the vulnerabilities can allow an attacker to obtain a fully privileged RouterOS session without legitimate authentication, provided the device's SSH service is reachable from the internet.
CERT Polska has confirmed that this is not merely a theoretical attack. Its researchers observed real attacks against exposed RouterOS devices and confirmed that the released patches prevent the observed exploitation.
How does the attack work?
The first vulnerability affects the way RouterOS verifies RSA public keys during SSH authentication.
CVE-2026-67276 means that RouterOS did not properly verify the complete RSA public key associated with an authorized account. Under certain conditions, an attacker who knows the username and public RSA modulus could construct a different key and authenticate without possessing the legitimate private key.
The second vulnerability, CVE-2026-86060, affects the handling of specially crafted usernames during the SSH login process.
An attacker can manipulate the RouterOS policy context through this flaw and escalate the resulting session to full administrative privileges.
The combination is what makes the situation particularly dangerous.
Rather than simply gaining access to a limited account, an attacker can potentially move directly toward complete control of the router.
Why full router access matters
A compromised router is much more than another infected endpoint.
An attacker with administrative control can potentially modify network configuration, create accounts, alter firewall rules, change routing, manipulate DNS-related settings or establish persistence through RouterOS features.
CERT Polska specifically recommends checking for unexpected:
- User accounts
- Scripts
- Scheduler tasks
- Proxy configurations
- Tunnels
- Other unexplained configuration changes
This is important because a router compromise can become a network-level security incident, potentially affecting systems that were never directly exposed to the internet.
Attackers are already exploiting exposed devices
CERT Polska says it has confirmed exploitation against RouterOS devices with SSH accessible from public networks.
The observed successful attacks, including creation of a highly privileged account named “ops”, originated from an IP address that CERT Polska tracked from at least September 2. Another IP address was observed attempting to exploit the vulnerability chain.
CERT Polska also identified characteristic log entries associated with observed exploitation, including:
login failure for user -2 from <ip> via ssh
and
user <name> added by ssh:-2@<ip>
The presence of these indicators should be treated seriously and investigated immediately.
However, their absence does not prove that a device has never been compromised.
MikroTik has released patches
MikroTik has released fixed RouterOS versions across its release channels.
The affected vulnerabilities are addressed in:
- RouterOS 7.24.2
- RouterOS 7.23.4
- RouterOS 6.49.21
- RouterOS 7.25 beta 3
MikroTik itself describes the update as an important security update and recommends upgrading.
Therefore, administrators should not wait for a convenient maintenance window if the affected router is exposed to the internet.
What should administrators do?
✅ Update RouterOS immediately
Upgrade affected devices to a fixed release.
For current stable branches, this means at least 7.24.2, 7.23.4, or 6.49.21, depending on the RouterOS branch being used.
✅ Check whether SSH is exposed
MikroTik notes that its default configuration blocks SSH from the internet, but administrators may have enabled external access manually.
SSH should not be exposed to untrusted networks.
Where remote administration is required, MikroTik recommends restricting access to trusted addresses or using a VPN such as WireGuard rather than exposing management ports directly to the internet.
✅ Look for signs of compromise
After updating, inspect the device for:
- Unknown users
- The “ops” account
- Unknown scripts
- Unexpected scheduled tasks
- New proxy settings
- Unexpected tunnels
- Unexplained configuration changes
- Relevant SSH log entries
RouterOS now includes a “Flagged” mechanism that can identify certain known signs of unauthorized modification.
But there is an important warning: a device without the Flagged status cannot automatically be considered clean. CERT Polska explicitly says the mechanism detects only selected traces of compromise.
What if the router may already be compromised?
This is where administrators need to be particularly careful.
If there are indications that the device was compromised, CERT Polska recommends isolating it and securing relevant logs and configuration before performing a reset.
The device should then be restored to factory settings and rebuilt from a trusted configuration.
Administrators should also change passwords, keys and other secrets that were used on the potentially compromised device.
A potentially compromised configuration backup should not simply be restored without verification, as doing so could reintroduce malicious changes or persistence.
The vulnerability extends beyond these two CVEs
CVE-2026-67276 and CVE-2026-86060 are not the only RouterOS vulnerabilities disclosed by CERT Polska.
The research identified six vulnerabilities affecting areas including:
- SSH
- The bandwidth-test service
- X.509 certificate handling
- WebFig
- RouterOS file handling
For example, CVE-2026-67277, rated CVSS 8.8, can allow unauthenticated attackers to reach an inappropriate state in the bandwidth-test service and potentially cause memory disclosure or a denial-of-service condition.
This makes updating the platform as a whole more important than addressing only the two vulnerabilities currently being actively exploited.
A warning for organizations
MikroTik routers are frequently deployed at branch offices, small businesses, industrial sites, remote locations and network edges.
Because these devices sit at the boundary between internal networks and the internet, their compromise can have consequences beyond the router itself.
Organizations should therefore treat an exposed MikroTik router as part of their security perimeter, not simply as networking infrastructure.
A compromised router may provide an attacker with an opportunity to:
establish persistence → manipulate network traffic → reach internal systems → monitor or redirect communications → maintain access
The exact consequences depend on the configuration and network architecture, but the potential impact is significant.
What organizations should check today
For security and infrastructure teams, a practical response should include:
Inventory
Identify all MikroTik devices and their RouterOS versions.
Exposure
Determine which devices have SSH or other management services accessible from the internet.
Patch
Upgrade vulnerable devices to a fixed RouterOS release.
Detection
Review logs and configurations for unexplained changes.
Identity
Check all RouterOS accounts, particularly privileged accounts.
Persistence
Review scripts, scheduler tasks, tunnels and proxy configuration.
Network security
Restrict management access to trusted networks or VPN infrastructure.
Incident response
If compromise is suspected, preserve evidence before resetting the device.
Final thoughts
The MikroTik RouterOS situation is a good example of why internet-facing network infrastructure requires the same level of vulnerability management as servers, applications and endpoints.
The vulnerabilities themselves are serious, but the most important factor is the confirmation that the attack chain is already being exploited in the wild.
Administrators should not treat this as a vulnerability to patch during the next routine maintenance cycle. Internet-exposed RouterOS devices should be assessed and updated immediately.
Network infrastructure is part of the attack surface. When authentication vulnerabilities are actively exploited, patching the router is only the first step — administrators must also verify that the device has not already been compromised.
