Cyber defenders are racing to contain a fresh wave of attacks targeting MikroTik RouterOS, as CERT Polska confirmed that threat actors are actively exploiting two critical SSH vulnerabilities in a coordinated takeover campaign. The Polish national cybersecurity team publicly disclosed six security flaws on September 5, but evidence shows that exploitation began at least three days earlier, with attackers chaining two high-severity bugs to gain full administrative control over internet-exposed routers and wireless equipment. The vulnerabilities, assigned CVE-2026-67276 and CVE-2026-86060, both carry a CVSS score of 9.2, placing them among the most dangerous issues to affect MikroTik’s widely deployed platform in recent years.
What is the MikroTik Attack Chain Known as MikroTrick?
MikroTrick is the name given by CERT Polska to the attack chain that combines two distinct SSH vulnerabilities in MikroTik RouterOS. The first flaw, CVE-2026-67276, is an authentication bypass rooted in incomplete RSA public-key validation. If an attacker knows a valid username and the corresponding public modulus of that user’s cryptographic key, they can forge a second key and authenticate to the server without ever possessing the legitimate private key. The second vulnerability, CVE-2026-86060, leverages improper handling of specially crafted usernames to escalate the resulting SSH session to full RouterOS administrator privileges. Exploiting both in sequence allows an unauthenticated remote attacker to achieve complete device takeover.
MikroTik RouterOS SSH Bugs: A Closer Look at the Exploited Vulnerabilities
The attack chain MikroTrick hinges on two vulnerabilities that were discovered through an AI-assisted research environment. CERT Polska used OpenAI’s GPT-5.5-cyber and GPT-5.6-sol models to automate version comparison, protocol analysis, binary analysis, and vulnerability testing. Every finding was validated on real RouterOS systems. The first flaw, CVE-2026-67276, exploits a gap in the way RouterOS checks RSA public keys during SSH authentication. Instead of requiring the full key pair, the system only validates the public modulus, making it possible for an attacker who knows a username and that modulus to craft a corresponding key. The second bug, CVE-2026-86060, takes advantage of how the system processes usernames: a specially crafted string can elevate the SSH session’s privileges from a standard user to the highest administrative level.
Beyond the core attack chain, CERT Polska identified a third critical vulnerability, CVE-2026-67277, with a CVSS score of 8.8. This flaw affects the bandwidth-test service, a built-in diagnostic tool. An unauthenticated attacker can exploit protocol-state and validation flaws to leak kernel memory or remotely crash and restart the device, effectively causing a denial of service. The researchers also documented vulnerabilities in X.509 certificate handling, the SSH client, and the WebFig management interface, but the exploitation activity has so far centered on the SSH-based chain.
How Can Administrators Detect if Their RouterOS Device Has Been Compromised?
CERT Polska has provided specific indicators of compromise that administrators should look for. The most telling signs appear in system logs. Entries such as “login failure for user -2 from via ssh” and “user added by ssh:-2@” indicate that the MikroTrick attack chain has been executed. Additionally, the attackers have been observed creating a highly privileged account named “ops”. Successful attacks involving this account originated from the IP address 82.192.72.4, while 103.102.31.18 was seen attempting to exploit the chain. However, the absence of these indicators does not guarantee that a device is clean. After installing the security update, RouterOS now scans for selected signs of unauthorized configuration changes and may mark affected devices as “Flagged”. Administrators can check this status using the command /system/device-mode/printcodecodecodecodecode. A Flagged device should be treated as potentially compromised, but a device without the marker may still have been breached.
Patches and Mitigation: What MikroTik Has Released
MikroTik, the Latvian networking vendor behind RouterOS, responded to the disclosures by releasing fixes in multiple versions: 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. The company maintains a broad version tree to support a wide range of hardware, and the patch coverage reflects that diversity. The update itself introduces a new security scanning capability that checks for signs of unauthorized configuration changes. Devices that exhibit suspicious modifications are flagged, giving administrators a clear starting point for forensic investigation. MikroTik’s September 2026 vulnerability advisory provides the full details on the patches and the affected versions.
For administrators who cannot immediately apply the updates, CERT Polska recommends restricting access to SSH, the web interfaces (WWW and WWW-SSL), and the bandwidth-test service to trusted management networks only. This is a temporary measure that reduces the attack surface until patching is possible. Given the critical nature of the vulnerabilities and the confirmed active exploitation, any delay in patching carries significant risk.
What Are the Broader Implications of the MikroTik RouterOS Exploitation?
The MikroTik RouterOS vulnerabilities are particularly concerning because of the platform’s widespread adoption. MikroTik routers and wireless equipment are used by internet service providers, enterprises, small businesses, and home users across the globe. The operating system is known for its flexibility and feature richness, but that complexity also introduces a larger attack surface. The fact that the attackers are chaining two SSH authentication bypasses to achieve full device takeover means that any device exposing SSH to the public internet is a potential target. This is a common configuration error, as many network administrators rely on SSH for remote management without proper access controls.
The use of AI-assisted research by CERT Polska to discover these vulnerabilities is a notable development. The researchers employed GPT-5.5-cyber and GPT-5.6-sol models to automate several stages of the vulnerability discovery process, including binary analysis and protocol testing. This approach may signal a shift in how cybersecurity research is conducted, with AI tools augmenting human expertise to find flaws faster. However, the same tools could also be used by malicious actors to discover vulnerabilities, raising the stakes for vendors to respond quickly once flaws are disclosed.
The exploitation campaign itself appears to be targeted but not limited to a specific geography. The indicators of compromise point to two distinct IP addresses: one in Poland (82.192.72.4) and one in Asia (103.102.31.18). This suggests that the attackers may be operating from multiple locations, and the campaign could expand. CERT Polska’s warning should be taken seriously by all MikroTik administrators, regardless of where their devices are located.
What Should Administrators Do After Patching?
Applying the update is only the first step. CERT Polska recommends that administrators inspect their devices for unknown users, scripts, scheduler tasks, proxies, tunnels, or other configuration changes. The attackers may have established persistence mechanisms beyond the initial compromise. If compromise is suspected, the organization should isolate the device from the network, preserve logs and configuration files for forensic analysis, perform a factory reset, and rebuild the device from a trusted configuration baseline. Passwords, cryptographic keys, and other secrets should be rotated as a precaution. The “Flagged” status in the updated RouterOS can help identify devices that have been tampered with, but it is not a foolproof indicator. Manual inspection and a thorough security review are essential.
For organizations with large fleets of MikroTik devices, this incident underscores the importance of asset management, network segmentation, and strict access controls. Exposing SSH to the public internet is a risky practice that should be avoided whenever possible. If remote management is necessary, it should be done through a VPN or a bastion host with strong authentication and logging. Regular vulnerability scanning and patch management are also critical, especially for devices that are part of critical infrastructure.
Looking ahead, the MikroTik RouterOS SSH bugs serve as a reminder that even well-established networking platforms can harbor serious flaws. The security community will continue to scrutinize RouterOS, and the use of AI-assisted research may accelerate the discovery of additional vulnerabilities. Administrators should stay informed about security advisories from MikroTik and CERT Polska, and treat any device that has been exposed to the internet as a potential risk. The attack chain MikroTrick is a clear demonstration of how a single weak point in authentication can lead to complete device takeover, and the lessons from this incident should inform security practices for years to come.
