MikroTik routers under active attack via new SSH flaws

Attack chain targets exposed SSH services

Hackers are actively exploiting two recently disclosed vulnerabilities in MikroTik routers to seize control of devices with SSH services exposed to the internet, according to a warning from Poland's CERT agency.

The attack chain, dubbed “MikroTrick,” combines an SSH authentication bypass (CVE-2026-67276) with an SSH privilege escalation flaw (CVE-2026-86060). Together, they allow an attacker to log in without the legitimate private key and then obtain full administrative privileges.

The Polish agency has observed attacks against RouterOS devices accessible from public networks and confirmed that attackers are leveraging this combination to take full control of such devices.

Two critical flaws, one path to admin

The first vulnerability, CVE-2026-67276, is an authentication bypass caused by incomplete validation of RSA public keys. An attacker who knows a username and the public modulus of that user's key can craft a different key and log in without the legitimate private key.

The second flaw, CVE-2026-86060, is a privilege escalation issue stemming from improper handling of specially crafted usernames. By using a specially crafted username, an attacker can manipulate the SSH session to gain full administrative privileges.

Both vulnerabilities were discovered by Poland's CERT with the assistance of GPT-5.5-cyber and GPT-5.6-sol, and both received a critical severity rating.

MikroTrick: Active exploitation confirmed

“In recent days we have been observing attacks against RouterOS devices accessible from the internet,” Poland's CERT warns.

“We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks.”

These quotations appear in the CERT's advisory, which has been published to warn administrators of the ongoing threat.

Third flaw adds remote crash risk

The Polish agency also highlighted a third vulnerability, CVE-2026-67277, which affects the RouterOS bandwidth-test service. This flaw allows unauthenticated attackers to leak kernel memory or remotely crash and restart the router.

While this third issue is not part of the MikroTrick chain, its presence adds another layer of risk for unpatched devices.

Patches available, but details withheld

MikroTik fixed these vulnerabilities in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, released on September 3, and Poland's CERT validated the fixes.

In its advisory, the vendor notes that not all configurations are affected, but it did not disclose any details to give users time to apply the updates. The updates include a compromise-detection mechanism that looks for known signs of unauthorized configuration changes at startup, disables malicious entries, and logs a critical warning.

However, the CERT cautions that the absence of a marker indicating compromise should not be taken as a guarantee that a router has not been compromised.

Indicators of compromise and response steps

The CERT shared specific indicators of compromise (IoCs) to help administrators identify potentially affected devices:

• Log entries: 'login failure for user -2 from via ssh' and 'user added by ssh:-2@'
• Presence of a highly privileged ops account
• 82.192.72.4 — linked to confirmed successful attacks
• 103.102.31.18 — observed attempting to exploit MikroTrick

If compromise is suspected, the Polish agency recommends isolating the router, preserving logs and configuration, then factory-resetting the device and rebuilding it from a trusted configuration while rotating passwords, keys, and other secrets.

Mitigation for unpatched devices

For administrators who cannot apply the updates immediately, the CERT suggests restricting or disabling externally accessible SSH, WWW/WWW-SSL, and bandwidth-test services. It also advises avoiding the built-in SSH clients and outbound TLS connections over untrusted networks.

The scale of exposure is significant: as of September 5, there were 122,500 MikroTik devices with an exposed SSH interface, according to data provided by The ShadowServer Foundation. The exact number of devices vulnerable to the MikroTik exploit was not determined.

What this means for router owners

The active exploitation of these flaws underscores the urgency for MikroTik router administrators to apply the available patches without delay. Given that the attack chain requires only knowing a username and the public modulus of a user's key, any router with SSH exposed to the internet could be at risk.

The compromise-detection mechanism added in the updates is a useful tool, but it is not foolproof, and the CERT's guidance makes clear that absence of a marker does not mean a device is clean. Organizations that rely on MikroTik routers should prioritize patching, review their SSH exposure, and consider whether they need to rotate credentials and rebuild configurations from a trusted source.

The presence of a third, unauthenticated flaw affecting the bandwidth-test service further emphasizes the importance of keeping RouterOS up to date and limiting exposure of management interfaces to the public internet.