New data from CERT Polska confirmed active exploitation of six vulnerabilities in MikroTik RouterOS, including a two-flaw chain dubbed ‘MikroTrick’ that can give attackers full administrative control of internet-accessible devices without authentication when SSH is exposed to public networks. Exploitation of the MikroTrick chain has been confirmed against RouterOS devices whose SSH services are accessible from public networks, with attacks occurring since at least Sept. 2.
Vulnerabilities affect the RouterOS SSH server and client, bandwidth-test service, X.509 certificate handling and WebFig interface. Among the most serious flaws are CVE-2026-67276, an SSH authentication bypass rated CVSS 9.2, and CVE-2026-86060, a crafted-username vulnerability that can provide full administrative privileges, also rated 9.2. CERT Polska said CVE-2026-67277, involving memory disclosure and remote denial of service through the bandwidth-test service, carries a CVSS score of 8.8.
The vulnerabilities were discovered by Sławomir Rozbicki from the CERT Polska team using the GPT-5.5-cyber and GPT-5.6-sol models as part of the team’s access to the OpenAI Government and Trust Agency Collaboration (GTAC) program. The models were used as part of an agent-based research environment to automate the laboratory and systematically search for vulnerabilities in areas selected and supervised by the researchers.
Observed attacks included the creation of a highly privileged account named ‘ops,’ while logs showed failed logins involving user ‘-2’ followed by the addition of users through SSH. The activity originated from the IP address 82.192.72.4, while 103.102.31.18 was used in exploitation attempts. MikroTik has released fixes in RouterOS versions 7.25beta3, 7.24.2, 7.23.4 and 6.49.21, and CERT Polska is urging administrators to update immediately and inspect devices for unknown users, scripts, scheduler tasks, proxy servers, tunnels and other unauthorized configuration changes.
“Along with this update, for the first time in history, MikroTik sent a push notification to the phones of users who had the MikroTik app installed,” the alert added.
“Administrators should update their devices as soon as possible and then check the configuration for unknown users, scripts, scheduler tasks, proxy servers, and tunnels.”
MikroTik develops router software and hardware for networks ranging from small offices to national internet service providers, data centers and large enterprises. The company says its products are used by internet service providers, businesses and individual users to build network infrastructure around the world. Its portfolio includes Ethernet routers, switches, wireless systems, LTE/5G products, IoT products and RouterBOARD hardware, placing its technology across network environments that can form part of the communications infrastructure supporting critical operations.
MikroTik’s RouterOS provides capabilities including complex firewall rules, IPsec hardware acceleration, VLANs, secure VPNs and API and TR-069 support for remote management and monitoring. The company says it has more than 250 products and a network of more than 800 distributors and resellers across 130 countries. Its product range also includes high-capacity Ethernet routers and switches designed for demanding environments, including equipment supporting 100-gigabit connectivity, redundant power supplies and high-density fiber connections.
In the course of its research, CERT Polska identified six vulnerabilities in RouterOS and highlighted three of the most important flaws. CVE-2026-67276, an SSH authentication bypass with a CVSS score of 9.2, stems from improper verification of public keys used for SSH authentication. RouterOS did not compare the entire RSA public key assigned to a user, allowing an attacker who knew the username and public modulus of the user’s key to craft a different key and log in through SSH without possessing corresponding private key. The attacker would obtain privileges equivalent to those of the targeted account.
CVE-2026-86060, also rated CVSS 9.2, involves SSH session privilege manipulation through a crafted username. RouterOS improperly handled usernames beginning with a disallowed character in its SSH login mechanism, allowing an attacker to elevate privileges and obtain a session with full administrative access to the RouterOS system.
CERT Polska also identified CVE-2026-67277, rated CVSS 8.8, which affects the bandwidth-test service. An unauthenticated connection could enter a state that normally requires authentication, and two additional flaws involving disclosure of uninitialized packet-buffer data and an integer underflow in size validation could enable kernel memory leakage or a remote denial-of-service attack that causes the system to restart.
“Technical indicators and information obtained by CERT Polska through internal channels pointed to the possibility of RouterOS vulnerabilities being actively exploited in real-world attacks conducted in recent days,” it added. “We now have confirmation that the combination of two of them (MikroTrick) is being exploited to take full control of devices whose SSH service is accessible from public networks. According to the information we have, updating to the latest version prevents these attacks.”
In the fixed releases, MikroTik used a mechanism that, at RouterOS startup, scans the configuration for known signs of unauthorized changes, disables the recognized suspicious configuration entries, writes a critical message to the log, and sets a warning (the ‘Flagged’ marker). This mechanism detects only selected traces left after a compromise – the absence of the marker is not proof that the device is safe.
“We cannot rule out the existence of vulnerabilities unknown to us that the vendor did not describe in the changelog,” the CERT Polska alert identified. “The ‘Flagged’ marker for compromised devices should therefore be treated as an indication of a possible earlier compromise, not as proof that one of the vulnerabilities reported by CERT Polska was exploited.”
The team prepared an isolated laboratory with MikroTik machines, documentation of their system architecture, and rules for safe test execution. The agent automated machine creation and restoration, downloading and comparing versions, analyzing RFCs and binary code, and building scripts that confirm the presence of vulnerabilities. Modeling protocols as state machines and checking what happens when a stage is skipped, repeated, or executed in the wrong order proved particularly effective.
“This was not, however, the result of a single instruction (prompt). Every hypothesis required confirmation on a real RouterOS system, negative control tests, repetition on a machine in a clean state, and an impact assessment by the researchers,” according to the alert. “Despite the high degree of automation, the most labor-intensive parts of the project were preparing useful context about RouterOS, designing a safe laboratory and tools, choosing research directions, and then fully verifying the results, eliminating false conclusions, and documenting the real impact of each vulnerability. The models significantly accelerated analysis and hypothesis exploration, but they did not replace these stages.”
CERT Polska recommended that RouterOS should be updated immediately to one of the versions containing the fixes: 7.25beta3, 7.24.2, 7.23.4 or 6.49.21. After updating, the logs should be checked for the device compromise message and the value of the flagged marker in the output. Configuration should also be reviewed for unknown users, scripts and other unrecognized changes. The inspection and subsequent steps should follow MikroTik’s security bulletin and the Flagged documentation referenced in it. The absence of the marker does not rule out an earlier compromise.
If the patch cannot be installed immediately, exposed services should be disabled or access to them should be blocked from all addresses outside trusted management networks. This applies in particular to SSH, WWW/WWW-SSL and the bandwidth-test server. TLS connections should not be initiated from an unpatched device, and the built-in SSH clients should not be used, particularly when communication passes through untrusted networks or is directed at untrusted hosts. These measures are temporary steps intended to reduce the attack surface and do not replace installation of a patched RouterOS version.
If the ‘Flagged’ marker, logs, configuration or other circumstances indicate a possible compromise, the device should be isolated from the network. Before a reset is performed, the logs and configuration should be secured. Instructions for obtaining this data are described in the CERT Polska article ‘MikroTik – securing logs and configuration.’ Information about the observed attack should be reported to the appropriate CSIRT team in accordance with its instructions.
After the material has been secured, the device should be restored to factory settings and reconfigured using a trusted and verified configuration. Passwords, keys and other secrets in use should also be changed. A full configuration backup originating from a potentially compromised device should not be restored blindly. The ‘Flagged’ marker should not be cleared before the analysis has been completed and the relevant material has been secured.
