Attackers are exploiting a chain of RouterOS vulnerabilities to hijack MikroTik devices with SSH open to the internet, CERT Polska found.
CERT Polska, Poland’s national CSIRT team, have discovered six vulnerabilities in RouterOS and coordinated their disclosure with MikroTik. Among the six, two combined let an attacker take full control of a device without authentication, provided the device has SSH accessible from the internet. They named this exploit chain MikroTrick.
“In recent days we have been observing attacks against RouterOS devices accessible from the internet. We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks,” the CERT Polska team wrote.
“It has also been confirmed that the released patches prevent the observed attacks. We recommend applying the update immediately,” they added.
The vulnerabilities were discovered using the GPT-5.5-cyber and GPT-5.6-sol models, through the team’s access to OpenAI’s Government and Trust Agency Collaboration program.
“At least 122,500 MikroTik devices with SSH accessible found per 24 hour scan window on 2026-09-05 (no vulnerability check),” the Shadowserver Foundation posted on Mastodon.
Traces of compromise
One of the flaws, CVE-2026-67276 (CVSS 9.2), is an SSH authentication bypass caused by RouterOS comparing only the public modulus of a user’s RSA key instead of the entire key, letting an attacker who knew a username and its modulus craft a different key and log in without the private key, gaining that account’s privileges.
CVE-2026-86060 (also CVSS 9.2) is a privilege escalation flaw in how RouterOS handled SSH usernames beginning with a disallowed character, letting an attacker craft a username that returned a session with full administrative privileges.
A third flaw, CVE-2026-67277 (CVSS 8.8), is in the bandwidth-test service, which let unauthenticated connections reach a state normally reserved for logged-in users. Combined with a leak of uninitialized packet-buffer data and an integer underflow in size validation, this could expose kernel memory or crash the device into a restart.
Three additional, lower-severity vulnerabilities affect the SSH client, X.509 certificate handling, and the WebFig interface.
The researchers listed the following log entries as indicators of the observed attacks:
- login failure for user -2 from
via ssh - user
added by ssh:-2@
A highly privileged user named “ops” showing up unexplained is another indicator. The team traced the confirmed successful attacks, including creation of that “ops” account, to the IP address 82.192.72.4, active since at least September 2, and it flagged a second address, 103.102.31.18, used in attempts to exploit the same chain.
Patches and detection
MikroTik released fixes in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, listed in its security bulletin.
“This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information,” MikroTik noted.
“For regular home device users the issue does not pose an immediate risk, but we still suggest all users to upgrade.”
The patched versions include a mechanism that scans the configuration at startup for known signs of unauthorized changes, disables recognized suspicious entries, writes a message to the log, and sets a “Flagged” marker.
“Even if your device is not in Flagged state, after upgrading your RouterOS, inspect your device configuration for any unknown scripts, users or other config you do not recognise,” MikroTik added.
Recommendations
CERT Polska recommends updating RouterOS immediately to 7.25beta3, 7.24.2, 7.23.4, or 6.49.21, then checking logs for the compromise message and the flagged marker value in the output of the /system/device-mode/print command, and reviewing the configuration for unknown users, scripts, and other unrecognized changes.
If the patch cannot be installed immediately, it recommends disabling exposed services, including SSH, WWW/WWW-SSL, and the bandwidth-test server, or restricting them to trusted management networks, and avoiding TLS connections or the built-in SSH client from an unpatched device over untrusted networks.
“These are only temporary measures that reduce the attack surface. They do not replace installing the patched RouterOS version.”
Researchers published this information on an accelerated schedule because the patched packages are already public, and comparative analysis of them has allowed the community to reconstruct some of the fixed bugs.
“We limit the description to the information administrators need and do not publish exploit code or details that would make automating attacks easier,” they concluded.
