Hackers Exploit MikroTik Vulnerabilities to Take Over MikroTik Routers Without Authentication
Attackers chained SSH authentication bypass CVE-2026-67276 and privilege flaw CVE-2026-86060 to fully hijack internet-exposed MikroTik routers before patches existed.
CERT Polska disclosed six MikroTik RouterOS vulnerabilities on September 5, 2026, and confirmed real-world exploitation of SSH-exposed devices beginning around September 2, before public disclosure and patched releases. The actively exploited MikroTrick chain pairs CVE-2026-67276, an SSH authentication bypass, with CVE-2026-86060, a session privilege manipulation flaw, both CVSS 9.2, yielding full administrative control of internet-facing routers. Bishop Fox independently reproduced a related chain using CVE-2026-67279 and CVE-2026-86060 and found post-compromise persistence, including unauthorized full-privilege accounts, scripts, and schedulers showing the unusual owner="0" value. Fixes are available in RouterOS 6.49.21, 7.23.4, and 7.24.2, but updating cannot remove attacker-created persistence.
- CVE-2026-67276 bypasses SSH authentication; CVE-2026-86060 manipulates session policy into full admin access.
- CERT Polska confirmed exploitation of SSH-exposed devices from around September 2, before disclosure.
- Bishop Fox reproduced a related chain using CVE-2026-67279 and CVE-2026-86060.
- Persistence artifacts include unauthorized accounts, scripts, and schedulers with unusual owner="0" value.
- Fixes ship in RouterOS 6.49.21, 7.23.4, 7.24.2; updates cannot remove existing persistence.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1136.001 Create Account: Local AccountT1053 Scheduled Task/Job
- Vendors
- MikroTik
- Products
- RouterOS
- Organizations
- CERT PolskaBishop Fox
- Countries
- Poland
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86060+2 related CVEs | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 group max | 6% | KEVPoC ×3 | KEV |
From the original article
3 min read at gbhackers.com
Attackers are actively exploiting a critical vulnerability chain dubbed MikroTrick to seize full administrative control of internet-exposed MikroTik RouterOS devices without valid credentials. CERT Polska disclosed six RouterOS vulnerabilities on September 5, 2026, warning that two critical vulnerabilities could be chained to take over publicly reachable routers. The Polish national CSIRT said it had confirmed […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.