MikroTik patches flaws currently being exploited to take over routers
MikroTik patches six RouterOS flaws, including the actively exploited MikroTrick SSH chain (CVE-2026-67276, CVE-2026-86060) enabling unauthenticated full router takeover.
MikroTik released patches in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21 for six vulnerabilities found by CERT Polska, affecting the SSH server/client, bandwidth-test service, X.509 handling, and WebFig. CVE-2026-67276, an RSA public-key validation flaw in the SSH server, lets an attacker who knows a username and key modulus authenticate as that user; CVE-2026-86060 then escalates privileges to root via special-character username handling. CERT Polska confirmed attackers are exploiting the chain to take full control of RouterOS devices with SSH exposed to the internet. Shadowserver Foundation scans show over 122,500 devices with internet-reachable SSH, concentrated in Brazil, the US, and Indonesia.
- MikroTrick chain combines SSH key forgery (CVE-2026-67276) with root privilege escalation (CVE-2026-86060).
- MikroTik's 'Flagged' status signals possible compromise but does not guarantee a device is clean.
- Mitigations: restrict SSH to trusted IPs or VPN, disable SSH/WWW/bandwidth-test, rotate keys and passwords.
- Compromised devices should be isolated, backed up, factory reset, and reconfigured from a clean file.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1068 Exploitation for Privilege Escalation
- Vendors
- MikroTik
- Products
- RouterOS
- Organizations
- CERT PolskaShadowserver Foundation
- Countries
- BrazilUnited StatesIndonesia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86060+1 related CVE | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 | 6% | KEVPoC ×3 | KEV |
From the original article
3 min read at csoonline.com
Networking gear manufacturer MikroTik has released patches for six vulnerabilities in its RouterOS firmware, two of which can be chained together to take over devices without authentication over SSH. The exploit chain, dubbed MikroTrick, is already being used by attackers in the wild.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.