Vulnerabilities

MikroTik RouterOS Is Under Active Attack — MikroTrick Can Take Over the Router

September 6, 2026

2 mins

The Mess: CERT Polska has confirmed active attacks against MikroTik RouterOS devices using a vulnerability chain dubbed MikroTrick. The chain can bypass SSH authentication and give an attacker full administrative control without knowing the victim’s password or private key.

The campaign is already happening in the wild. CERT Polska says successful attacks have been observed since at least September 2 against RouterOS devices with SSH exposed to the Internet.

Two vulnerabilities make the takeover possible: CVE-2026-67276 allows SSH authentication bypass, while CVE-2026-86060 can manipulate the SSH session into obtaining full administrative privileges. Both carry a CVSS score of 9.2.

The Damage: A compromised router becomes an attacker-controlled network device, potentially giving them visibility into traffic, persistence inside the network, and the ability to modify routing, tunnels, firewall rules and other configuration.

CERT Polska also found four additional RouterOS vulnerabilities affecting SSH, bandwidth-test, X.509 handling and WebFig. One of them, CVE-2026-67277, can expose kernel memory or cause a remote denial of service.

The attacks leave specific traces. CERT Polska observed unauthorized account creation through SSH and a highly privileged account named “ops” on compromised devices. MikroTik’s patched releases also introduce a “Flagged” mechanism that can identify selected signs of compromise — but the absence of that flag does not prove the router is clean.

The Fix: Update RouterOS immediately to 7.24.2, 7.23.4 or 6.49.21 depending on the installed branch, then inspect logs and configuration for unknown users, scripts, scheduler tasks, tunnels and other unauthorized changes.

If an update cannot be installed immediately, Internet-facing SSH, WebFig and bandwidth-test access should be restricted to trusted management networks. These mitigations reduce exposure but do not replace the update.

If compromise is suspected, CERT Polska recommends isolating the device, preserving logs and configuration before resetting it, then rebuilding it from a trusted configuration and rotating passwords, keys and other secrets.

Bugstoday’s Opinion

This is exactly what network administrators don’t want to see on a Sunday morning: a router vulnerability that isn’t theoretical anymore.

The scary part isn’t the CVSS score. It’s the combination of Internet exposure + authentication bypass + active exploitation + full device takeover.

And routers are rarely treated like endpoints. They sit quietly at the edge of the network until someone owns them.

Patch the router. Check the logs. Then check it again.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources