Hackers exploit RouterOS flaws to hijack MikroTik devices without authentication
CERT Polska confirms attackers exploit chained MikroTik RouterOS SSH flaws to hijack devices without authentication; patches released in four RouterOS versions.
CERT Polska discovered six RouterOS vulnerabilities and confirmed active attacks chaining CVE-2026-67276 (CVSS 9.2, SSH authentication bypass caused by comparing only RSA key moduli) and CVE-2026-86060 (CVSS 9.2, privilege escalation via crafted usernames), dubbed MikroTrick. A third flaw, CVE-2026-67277 (CVSS 8.8) in the bandwidth-test service, can expose kernel memory or crash devices. Shadowserver counted about 122,500 MikroTik devices with SSH exposed; attackers created a privileged 'ops' account from IP 82.192.72.4, active since September 2. Fixes shipped in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, adding startup configuration scanning with a 'Flagged' marker for unauthorized changes.
- MikroTrick chain: SSH auth bypass plus privilege escalation gives unauthenticated full control
- CVE-2026-67276 and CVE-2026-86060 both rated CVSS 9.2; CVE-2026-67277 rated CVSS 8.8
- ~122,500 devices with exposed SSH per Shadowserver scan on 2026-09-05
- Patched versions scan configs at startup, disable suspicious entries, and set a 'Flagged' marker
- Workarounds: disable or restrict SSH, WWW/WWW-SSL, and bandwidth-test services until patched
- Products
- RouterOS
- Organizations
- CERT PolskaOpenAI
- Countries
- Poland
- AI models
- GPT-5.5-cyberGPT-5.6
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86060+2 related CVEs | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 group max | 6% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.102.31.18 | ince at least September 2, and it flagged a second address, 103.102.31.18, used in attempts to exploit the same chain. Patches and de |
| ipv4 | 82.192.72.4 | including creation of that “ops” account, to the IP address 82.192.72.4, active since at least September 2, and it flagged a second |
From the original article
3 min read at helpnetsecurity.com
Attackers are exploiting a chain of RouterOS vulnerabilities to hijack MikroTik devices with SSH open to the internet, CERT Polska found. CERT Polska, Poland’s national CSIRT team, have discovered six vulnerabilities in RouterOS and coordinated their disclosure with MikroTik.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.