Hackers exploit RouterOS flaws to hijack MikroTik devices without authentication
CERT Polska confirms attackers exploit chained MikroTik RouterOS SSH flaws to hijack devices without authentication; patches released in four RouterOS versions.
CERT Polska discovered six RouterOS vulnerabilities and confirmed active attacks chaining CVE-2026-67276 (CVSS 9.2, SSH authentication bypass caused by comparing only RSA key moduli) and CVE-2026-86060 (CVSS 9.2, privilege escalation via crafted usernames), dubbed MikroTrick. A third flaw, CVE-2026-67277 (CVSS 8.8) in the bandwidth-test service, can expose kernel memory or crash devices. Shadowserver counted about 122,500 MikroTik devices with SSH exposed; attackers created a privileged 'ops' account from IP 82.192.72.4, active since September 2. Fixes shipped in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, adding startup configuration scanning with a 'Flagged' marker for unauthorized changes.
- MikroTrick chain: SSH auth bypass plus privilege escalation gives unauthenticated full control
- CVE-2026-67276 and CVE-2026-86060 both rated CVSS 9.2; CVE-2026-67277 rated CVSS 8.8
- ~122,500 devices with exposed SSH per Shadowserver scan on 2026-09-05
- Patched versions scan configs at startup, disable suspicious entries, and set a 'Flagged' marker
- Workarounds: disable or restrict SSH, WWW/WWW-SSL, and bandwidth-test services until patched
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-67276 | SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x MikroTik RouterOS 7.x fails to compare the complete RSA public key when matching an SSH authentication attempt against an authorized user key, checking the key type and modulus but omitting the exponent. Because RouterOS verifies the signature against the client-supplied key, an attacker who knows the modulus of an authorized RSA key can present a key with exponent 1 and a forged signature and be accepted as that user without possessing the private key. Successful exploitation opens an SSH command channel as the target user, giving the attacker control of the router without a password or key. Only the RouterOS 7.x branch is affected, with fixes released in 7.23.4 (Long-term) and 7.24.2 (Stable). A public proof-of-concept is available and related reporting describes active campaigns hijacking MikroTik routers using chained RouterOS flaws, though this CVE is not in CISA KEV and its 30-day EPSS probability is low (0.2%). Do: Upgrade affected devices to RouterOS 7.23.4 (Long-term) or 7.24.2 (Stable) or later. Until patched, restrict SSH access to trusted management networks and, if feasible, remove or replace RSA authorized keys with other key types. Check devices for signs of compromise highlighted in recent reporting, such as an unexpected SSH user named '-2'. | 9.2 | <1% |
| mass~1M RouterOS 7.x devices (installed base in the millions; hundreds of thousands internet-exposed, with SSH a standard management service) | ||
| CVE-2026-86060 +1 in the same advisory: …67277 | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV. Do: Upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as applicable. Until patched, restrict SSH (TCP 22) to trusted management networks or disable the SSH service if unused, and review authentication logs and user/group policy settings for tampering — reports indicate attackers log in with usernames beginning with '-' (e.g., '-2'). | 9.2 group max | 1% | KEV PoC ×2 |
| mass≈1M+ devices: hundreds of thousands to over a million RouterOS devices are routinely observed internet-exposed, and far more expose SSH to the LAN |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.102.31.18 | ince at least September 2, and it flagged a second address, 103.102.31.18, used in attempts to exploit the same chain. Patches and de |
| ipv4 | 82.192.72.4 | including creation of that “ops” account, to the IP address 82.192.72.4, active since at least September 2, and it flagged a second |
Full article719 words · extracted from helpnetsecurity.com · click to collapse
Attackers are exploiting a chain of RouterOS vulnerabilities to hijack MikroTik devices with SSH open to the internet, CERT Polska found.
CERT Polska, Poland’s national CSIRT team, have discovered six vulnerabilities in RouterOS and coordinated their disclosure with MikroTik. Among the six, two combined let an attacker take full control of a device without authentication, provided the device has SSH accessible from the internet. They named this exploit chain MikroTrick.
“In recent days we have been observing attacks against RouterOS devices accessible from the internet. We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks,” the CERT Polska team wrote.
“It has also been confirmed that the released patches prevent the observed attacks. We recommend applying the update immediately,” they added.
The vulnerabilities were discovered using the GPT-5.5-cyber and GPT-5.6-sol models, through the team’s access to OpenAI’s Government and Trust Agency Collaboration program.
“At least 122,500 MikroTik devices with SSH accessible found per 24 hour scan window on 2026-09-05 (no vulnerability check),” the Shadowserver Foundation posted on Mastodon.
Traces of compromise
One of the flaws, CVE-2026-67276 (CVSS 9.2), is an SSH authentication bypass caused by RouterOS comparing only the public modulus of a user’s RSA key instead of the entire key, letting an attacker who knew a username and its modulus craft a different key and log in without the private key, gaining that account’s privileges.
CVE-2026-86060 (also CVSS 9.2) is a privilege escalation flaw in how RouterOS handled SSH usernames beginning with a disallowed character, letting an attacker craft a username that returned a session with full administrative privileges.
A third flaw, CVE-2026-67277 (CVSS 8.8), is in the bandwidth-test service, which let unauthenticated connections reach a state normally reserved for logged-in users. Combined with a leak of uninitialized packet-buffer data and an integer underflow in size validation, this could expose kernel memory or crash the device into a restart.
Three additional, lower-severity vulnerabilities affect the SSH client, X.509 certificate handling, and the WebFig interface.
The researchers listed the following log entries as indicators of the observed attacks:
- login failure for user -2 from via ssh
- user added by ssh:-2@
A highly privileged user named “ops” showing up unexplained is another indicator. The team traced the confirmed successful attacks, including creation of that “ops” account, to the IP address 82.192.72.4, active since at least September 2, and it flagged a second address, 103.102.31.18, used in attempts to exploit the same chain.
Patches and detection
MikroTik released fixes in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, listed in its security bulletin.
“This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information,” MikroTik noted.
“For regular home device users the issue does not pose an immediate risk, but we still suggest all users to upgrade.”
The patched versions include a mechanism that scans the configuration at startup for known signs of unauthorized changes, disables recognized suspicious entries, writes a message to the log, and sets a “Flagged” marker.
“Even if your device is not in Flagged state, after upgrading your RouterOS, inspect your device configuration for any unknown scripts, users or other config you do not recognise,” MikroTik added.
Recommendations
CERT Polska recommends updating RouterOS immediately to 7.25beta3, 7.24.2, 7.23.4, or 6.49.21, then checking logs for the compromise message and the flagged marker value in the output of the /system/device-mode/print command, and reviewing the configuration for unknown users, scripts, and other unrecognized changes.
If the patch cannot be installed immediately, it recommends disabling exposed services, including SSH, WWW/WWW-SSL, and the bandwidth-test server, or restricting them to trusted management networks, and avoiding TLS connections or the built-in SSH client from an unpatched device over untrusted networks.
“These are only temporary measures that reduce the attack surface. They do not replace installing the patched RouterOS version.”
Researchers published this information on an accelerated schedule because the patched packages are already public, and comparative analysis of them has allowed the community to reconstruct some of the fixed bugs.
“We limit the description to the information administrators need and do not publish exploit code or details that would make automating attacks easier,” they concluded.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/09/07/mikrotik-routeros-ssh-vulnerabilities-exploited/