MikroTik patches six RouterOS flaws; two chained as MikroTrick are actively exploited via SSH to fully compromise exposed routers.
MikroTik released patches for six RouterOS vulnerabilities, including actively exploited MikroTrick chain: CVE-2026-67276 (9.2, SSH auth bypass) and CVE-2026-86060 (9.2, privilege manipulation), plus CVE-2026-67277 (8.8). CERT Poland confirms exploitation since September 2, creating an 'ops' account from IPs 82.192.72.4 and 103.102.31.18. Fixed in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21; Shadowserver found 120,000+ SSH-exposed MikroTik devices.
Attackers actively exploit a MikroTik RouterOS SSH authentication bypass and privilege escalation chain, dubbed MikroTrick, to fully hijack internet-exposed routers.
Poland's CERT, with help from GPT-5.5-cyber and GPT-5.6-sol, discovered and confirmed active exploitation of a MikroTik RouterOS chain dubbed MikroTrick: SSH authentication bypass CVE-2026-67276 (incomplete RSA public key validation) chained with privilege escalation CVE-2026-86060 (crafted usernames granting full administrative privileges). A third flaw, CVE-2026-67277, allows unauthenticated kernel memory leaks or router crashes via the bandwidth-test service. Fixes shipped September 3 in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, adding a startup compromise-detection mechanism. Shadowserver data showed 122,500 MikroTik devices with exposed SSH interfaces as of September 5, and the CERT published IoCs including two attacker IP addresses.
CERT Polska warns attackers exploit internet-exposed MikroTik SSH for unauthenticated full admin control; attacks observed since at least September 2.
CERT Polska warned on September 5 that attackers exploit MikroTik routers with internet-reachable SSH to gain full administrative control without authentication, calling the two-flaw combination 'MikroTrick'. Successful attacks date to at least September 2; no victim count or attacker identity was disclosed. MikroTik shipped fixed RouterOS releases: 6.49.21, 7.23.4 (with 7.23.5 fixing an IPv6 DHCP regression), 7.24.2, and 7.25beta3. CERT recommends immediate updates, checking for unauthorized configuration changes, and restricting SSH, WWW/WWW-SSL, and bandwidth-test services on unpatched devices.
Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation
CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV.
· MikroTik RouterOS v6 (Long-term channel) versions prior to 6.49.21 (fixed in 6.49.21) · MikroTik RouterOS v7 (Long-term channel) versions prior to 7.23.4 (fixed in 7.23.4) KEV PoC ×2mass
Unauthenticated Kernel Crash and Memory Leak in MikroTik RouterOS btest
CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the bandwidth-test (btest) service of MikroTik RouterOS: the service accepts a "related" btest connection before the primary session has completed authentication, so an unauthenticated remote client can start an IPv4 UDP bandwidth test. When the test runs with "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer, leaking a small amount of kernel memory, and a separate unchecked, inverted packet-size interval causes an unsigned integer underflow that produces anomalously large fragmented output capable of restarting the RouterOS kernel. An unauthenticated network attacker therefore gains limited information disclosure and, more significantly, a remote denial of service through repeated router crashes, with no credentials or user interaction required (CVSS 4.0: 8.8 High). Any MikroTik device running an unpatched RouterOS version with the bandwidth-test server enabled and reachable from an untrusted network is affected. No public PoC or CISA KEV listing exists for this CVE and EPSS is low (0.4%), but it is part of the batch of RouterOS fixes in MikroTik advisory AV26-887 that attackers have recently chained to hijack routers, so in-the-wild exploitation of the flaw set is reported.
· MikroTik RouterOS (Long-term channel, v6) All versions prior to 6.49.21 (fixed in 6.49.21) · MikroTik RouterOS (Long-term channel, v7) All versions prior to 7.23.4 (fixed in 7.23.4) KEV PoC mass
SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x
MikroTik RouterOS 7.x fails to compare the complete RSA public key when matching an SSH authentication attempt against an authorized user key, checking the key type and modulus but omitting the exponent. Because RouterOS verifies the signature against the client-supplied key, an attacker who knows the modulus of an authorized RSA key can present a key with exponent 1 and a forged signature and be accepted as that user without possessing the private key. Successful exploitation opens an SSH command channel as the target user, giving the attacker control of the router without a password or key. Only the RouterOS 7.x branch is affected, with fixes released in 7.23.4 (Long-term) and 7.24.2 (Stable). A public proof-of-concept is available and related reporting describes active campaigns hijacking MikroTik routers using chained RouterOS flaws, though this CVE is not in CISA KEV and its 30-day EPSS probability is low (0.2%).
· MikroTik RouterOS 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable)mass
Unauthenticated Arbitrary File Read in MikroTik RouterOS WebFig (CVE-2026-67281)
RouterOS WebFig's /jsproxy handler contains an unauthenticated file-read flaw: a newly allocated session keeps a stale, uninitialized principal pointer that is later used to authorize file access (CWE-824), combined with a path-traversal issue (CWE-22). An unauthenticated attacker who can reach the web interface first shapes the heap allocator so the uninitialized pointer resolves with sufficient rights, then submits an encrypted URI containing parent-directory components to escape the WebFig file namespace. This lets the attacker read root-owned files on the router, including configuration stores that contain credentials, which could enable further compromise. Only MikroTik RouterOS 7.x before 7.23.4 (Long-term) and 7.24.2 (Stable) is affected. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation of this flaw is known (EPSS ~0.4%), although recent reporting notes MikroTik patches being chained in router-hijack campaigns generally.
· MikroTik RouterOS (WebFig /jsproxy) 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable); fixed in 7.23.4 and 7.24.2mass
Unauthenticated SSH Session Bypass Enables File Writes in MikroTik RouterOS
CVE-2026-67279 is an authentication-ordering flaw (CWE-841) in the SSH server of MikroTik RouterOS: after a client-requested SSH rekey, the server enters the connection protocol even though user authentication was never attempted. An unauthenticated SSH client can therefore open a session channel and send an exec request, and on affected builds the server dispatches the command without any credentials. This lets the attacker create, overwrite, and reconstruct files in the RouterOS managed file namespace, including support files that contain configuration and diagnostic data. Any MikroTik device running RouterOS builds older than the fixed releases is affected, although remote exploitation requires the SSH service to be reachable by the attacker. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS estimates a 0.4% probability of exploitation in the next 30 days, so no exploitation is currently known.
· MikroTik RouterOS (Long-term branch, v6) prior to 6.49.21 · MikroTik RouterOS (Long-term branch, v7) prior to 7.23.4mass
X.509 Signature Forgery Enables TLS Impersonation in MikroTik RouterOS 7.x
MikroTik RouterOS 7.x improperly verifies RSA/PKCS#1 v1.5 signatures when validating X.509 certificate chains, accepting malformed signatures (CWE-347, Improper Verification of Cryptographic Signature). Because the RouterOS trust store includes a root CA whose public key uses the small exponent e=3, an attacker who can control or redirect one of the router's outbound TLS connections (for example via a network man-in-the-middle position, DNS hijacking, or a compromised upstream path) can forge an intermediate CA signed with the root's public key, without ever holding its private key, and mint trusted certificates for arbitrary hostnames. This lets the attacker impersonate TLS servers the router connects to, with low confidentiality and integrity impact per the CVSS 4.0 score of 6.3 (medium), which reflects the network vector, no privileges required, but a high attack requirement of holding such a network position. Any deployment running RouterOS 7.x before 7.23.4 (Long-term) or 7.24.2 (Stable) is affected, spanning home/SOHO, enterprise, and ISP/WISP infrastructure; the 6.x branch is not listed as affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and EPSS gives a 0.2% probability of exploitation within 30 days, although related headlines note other MikroTik flaws have recently been chained to hack routers.
· MikroTik RouterOS 7.x before 7.23.4 (Long-term) and before 7.24.2 (Stable); the 6.x branch is not affectedmass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.