- The Mess: CERT Polska found six RouterOS vulnerabilities and confirmed that attackers are already chaining two of them to take full control of exposed MikroTik routers without authentication.
- The Damage: A vulnerable Internet-facing router can become an attacker-controlled network pivot, with new administrator accounts, scripts, tunnels and other persistence mechanisms left behind.
- The Fix: Upgrade RouterOS immediately, close Internet-facing SSH, then inspect the router for signs of compromise even if the new
Flaggedmechanism reports nothing.
This is not a theoretical RouterOS bug.
CERT Polska has confirmed active exploitation of a vulnerability chain it calls MikroTrick. The chain combines two separate SSH flaws to turn an exposed RouterOS device into an attacker-controlled administrator session.
Six vulnerabilities were disclosed in total.
Two of them are the important part of the attack chain:
- CVE-2026-67276 — SSH authentication bypass
- CVE-2026-86060 — SSH session privilege manipulation
CERT Polska rates both at CVSS 9.2.
A third vulnerability, CVE-2026-67277, allows unauthenticated interaction with the bandwidth-test service and can result in kernel memory disclosure or a remote denial of service.
The scary part is not the CVE count.
It is the fact that attackers are already using the chain.
The SSH authentication check was broken
CVE-2026-67276 lives inside RouterOS SSH public-key authentication.
RouterOS did not properly compare the complete RSA public key supplied during authentication.
It checked the key type and modulus.
It failed to properly account for the exponent.
That sounds like an implementation detail.
It isn’t.
An attacker who knows the username and RSA public modulus associated with an authorized key can construct a different key and forge a signature accepted by the vulnerable SSH implementation.
The attacker does not possess the legitimate private key.
Yet RouterOS can still open the SSH command channel as the targeted account.
That gives the attacker the first foothold.
MikroTrick then turns that foothold into something considerably worse.
The second bug turns the foothold into admin
CVE-2026-86060 affects RouterOS SSH session handling.
A specially crafted username containing a disallowed character can manipulate the SSH session and result in a session with full administrative privileges.
CERT Polska describes the resulting session as having administrator-level privileges.
So the chain looks like this:
Internet
↓
RouterOS SSH
↓
CVE-2026-67276
↓
SSH authentication bypass
↓
CVE-2026-86060
↓
privilege manipulation
↓
RouterOS administrator
No legitimate password.
No legitimate private key.
No user interaction.
That is what makes MikroTrick substantially more dangerous than a normal authentication bug.
Attackers are already using it
CERT Polska isn’t speculating about exploitation.
It observed attacks against RouterOS devices accessible from the Internet and obtained confirmation that the two vulnerabilities are being chained to take complete control of vulnerable devices.
The observed attacks left specific artifacts.
One of the most useful is this RouterOS log pattern:
login failure for user -2 from <ip> via ssh
user <name> added by ssh:-2@<ip>
CERT Polska also identified a highly privileged user named:
ops
as an indicator of compromise.
The observed successful attacks and creation of the ops account originated from:
82.192.72.4
with additional exploitation attempts associated with:
103.102.31.18
CERT Polska says the observed activity dates back to at least September 2, 2026.
If those addresses or artifacts appear in your RouterOS logs, don’t treat them as random Internet noise.
Investigate the device.
MikroTik added a tripwire
There is an unusual part to this incident.
The patched RouterOS releases contain a new mechanism that checks the configuration for known indicators of unauthorized modification during startup.
If suspicious configuration is detected, RouterOS can set the device to:
Flagged
and write a critical message to the log.
That sounds useful.
It is.
But it is not an integrity guarantee.
CERT Polska explicitly warns that the mechanism only detects selected traces left by a compromise.
A router without the Flagged status is not automatically clean.
This distinction matters because an attacker who understands the detection mechanism can potentially avoid leaving the exact artifacts it searches for.
The Flagged mechanism is an indicator.
Not a forensic verdict.
Six vulnerabilities, not one
MikroTrick gets most of the attention, but CERT Polska disclosed six RouterOS vulnerabilities:
| CVE | Component | Impact |
|---|---|---|
| CVE-2026-67276 | SSH | Authentication bypass |
| CVE-2026-86060 | SSH | Privilege manipulation |
| CVE-2026-67277 | bandwidth-test | Memory disclosure / DoS |
| CVE-2026-67278 | X.509 | Cryptographic verification flaw |
| CVE-2026-67279 | RouterOS workflow | Improper workflow enforcement |
| CVE-2026-67281 | RouterOS | Uninitialized pointer access |
The vulnerabilities affect different RouterOS components, including SSH, the bandwidth-test service, X.509 handling and WebFig.
This is why simply changing an SSH password isn’t enough.
The device needs to be patched.
The bandwidth-test service has its own problem
CVE-2026-67277 is particularly interesting because it doesn’t depend on the SSH takeover chain.
RouterOS accepted a related bandwidth-test connection before authentication of the corresponding primary session had completed.
That state could be combined with other bugs involving uninitialized packet-buffer data and integer underflow during size validation.
The result:
kernel memory disclosure or remote denial of service.
This is a useful reminder that management appliances have more than one attack surface.
Administrators often focus on:
SSH
Winbox
WebFig
and forget secondary services.
Attackers don’t.
Patch versions
MikroTik released fixes across the RouterOS branches:
- 7.25 beta 3
- 7.24.2
- 7.23.4
- 6.49.21
and newer versions.
The vendor specifically recommends ensuring that SSH is not exposed to untrusted networks.
MikroTik’s default configuration normally blocks SSH from the Internet, but administrators who manually opened it are exposed to the attack surface. The vendor recommends restricting management access to trusted networks or using a VPN such as WireGuard instead of exposing management services directly.
What to check after patching
Do not stop when RouterOS says:
Update successful.
If the router was previously exposed, inspect it.
Look for:
- unknown users;
- the
opsaccount; - unknown SSH keys;
- unexpected scripts;
- scheduler tasks;
- proxy configuration;
- tunnels;
- suspicious firewall changes;
- unexpected device-mode settings;
- unexplained configuration modifications.
CERT Polska specifically recommends checking users, scripts, scheduler tasks, proxy servers and tunnels after updating.
Then inspect the RouterOS logs.
Look for:
user -2
ssh:-2
user added by ssh
and the known source addresses associated with observed attacks.
Again, absence of those indicators does not prove that the router was never compromised.
If RouterOS says Flagged
Take it seriously.
CERT Polska’s recommendation is effectively to assume compromise when the device has been flagged and follow the incident-response procedure rather than simply clearing the flag.
MikroTik also warns that the Flagged state does not automatically clean the configuration. Administrators still need to inspect the device after upgrading.
This is an important distinction:
patching closes the hole.
It does not undo what an attacker already did through that hole.
MikroTik routers are attractive targets
A compromised workstation is bad.
A compromised router is different.
The router sits in the middle of everything.
An attacker with administrative RouterOS access can potentially manipulate:
- DNS;
- routing;
- firewall rules;
- NAT;
- VPN tunnels;
- proxy services;
- traffic inspection;
- network segmentation;
- remote-access configuration.
That turns a single vulnerable appliance into a potential pivot point for the rest of the network.
A MikroTik device is infrastructure.
Treat it like infrastructure.
Bugstoday’s take
MikroTrick is exactly the kind of vulnerability chain administrators should fear.
The first bug breaks authentication.
The second breaks privilege boundaries.
The attacker gets administrator access.
Then the router becomes theirs.
The fact that CERT Polska has already confirmed exploitation makes this even less interesting as a theoretical CVE story. This is an active campaign against exposed infrastructure.
And there is a particularly nasty lesson here:
a router that looks fine after the update may not actually be fine.
Check the logs.
Check the users.
Check the scripts.
Check the tunnels.
Check the configuration.
Then check it again.
Because once somebody owns the router sitting between your users and the Internet, your firewall has effectively become their firewall.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- CERT Polska — MikroTik RouterOS active exploitation advisory
- CERT Polska — RouterOS CVE technical details
- MikroTik — September 2026 security advisory
- MikroTik — Security announcements
