MikroTik router flaws allow takeover without a password
Attackers actively exploit chained MikroTik RouterOS SSH flaws CVE-2026-67276 and CVE-2026-86060, bypassing authentication and escalating to admin to seize edge routers.
CERT Polska warns of active exploitation of a two-flaw chain dubbed 'MikroTrick' against internet-exposed MikroTik RouterOS devices with SSH remote management enabled. CVE-2026-67276 is an SSH authentication bypass in RSA public-key handling, and CVE-2026-86060 is a privilege-escalation flaw triggered via a specially crafted username, letting attackers gain full administrator control without a password. Patched RouterOS packages are already public, and MikroTik added a startup detection that flags unauthorized configuration changes. Compromised edge routers enable DNS hijacking, traffic capture, remote-access tunnels, firewall changes, and lateral attacks.
- MikroTrick chain combines auth bypass (CVE-2026-67276) and priv-esc (CVE-2026-86060)
- Requires vulnerable RouterOS with SSH exposed to the internet
- Patched RouterOS available; update via Check for updates or vendor packages
- RouterOS now flags suspicious config changes at startup for audit
- Defenders should restrict SSH to trusted IPs and audit flagged devices
- Vendors
- MikroTik
- Products
- RouterOS
- Organizations
- CERT Polska
- Countries
- Poland
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86060+1 related CVE | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 | 6% | KEVPoC ×3 | KEV |
From the original article
2 min read at malwarebytes.com
Attackers are exploiting critical RouterOS flaws to take control of routers with SSH exposed to the internet.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.