MikroTik patches flaws currently being exploited to take over routers
MikroTik patches six RouterOS flaws, including the actively exploited MikroTrick SSH chain (CVE-2026-67276, CVE-2026-86060) enabling unauthenticated full router takeover.
MikroTik released patches in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21 for six vulnerabilities found by CERT Polska, affecting the SSH server/client, bandwidth-test service, X.509 handling, and WebFig. CVE-2026-67276, an RSA public-key validation flaw in the SSH server, lets an attacker who knows a username and key modulus authenticate as that user; CVE-2026-86060 then escalates privileges to root via special-character username handling. CERT Polska confirmed attackers are exploiting the chain to take full control of RouterOS devices with SSH exposed to the internet. Shadowserver Foundation scans show over 122,500 devices with internet-reachable SSH, concentrated in Brazil, the US, and Indonesia.
- MikroTrick chain combines SSH key forgery (CVE-2026-67276) with root privilege escalation (CVE-2026-86060).
- MikroTik's 'Flagged' status signals possible compromise but does not guarantee a device is clean.
- Mitigations: restrict SSH to trusted IPs or VPN, disable SSH/WWW/bandwidth-test, rotate keys and passwords.
- Compromised devices should be isolated, backed up, factory reset, and reconfigured from a clean file.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-67276 | SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x MikroTik RouterOS 7.x fails to compare the complete RSA public key when matching an SSH authentication attempt against an authorized user key, checking the key type and modulus but omitting the exponent. Because RouterOS verifies the signature against the client-supplied key, an attacker who knows the modulus of an authorized RSA key can present a key with exponent 1 and a forged signature and be accepted as that user without possessing the private key. Successful exploitation opens an SSH command channel as the target user, giving the attacker control of the router without a password or key. Only the RouterOS 7.x branch is affected, with fixes released in 7.23.4 (Long-term) and 7.24.2 (Stable). A public proof-of-concept is available and related reporting describes active campaigns hijacking MikroTik routers using chained RouterOS flaws, though this CVE is not in CISA KEV and its 30-day EPSS probability is low (0.2%). Do: Upgrade affected devices to RouterOS 7.23.4 (Long-term) or 7.24.2 (Stable) or later. Until patched, restrict SSH access to trusted management networks and, if feasible, remove or replace RSA authorized keys with other key types. Check devices for signs of compromise highlighted in recent reporting, such as an unexpected SSH user named '-2'. | 9.2 | <1% |
| mass~1M RouterOS 7.x devices (installed base in the millions; hundreds of thousands internet-exposed, with SSH a standard management service) | ||
| CVE-2026-86060 | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV. Do: Upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as applicable. Until patched, restrict SSH (TCP 22) to trusted management networks or disable the SSH service if unused, and review authentication logs and user/group policy settings for tampering — reports indicate attackers log in with usernames beginning with '-' (e.g., '-2'). | 9.2 | 1% | KEV PoC ×2 |
| mass≈1M+ devices: hundreds of thousands to over a million RouterOS devices are routinely observed internet-exposed, and far more expose SSH to the LAN |
Full article659 words · extracted from csoonline.com · click to collapse
Networking gear manufacturer MikroTik has released patches for six vulnerabilities in its RouterOS firmware, two of which can be chained together to take over devices without authentication over SSH. The exploit chain, dubbed MikroTrick, is already being used by attackers in the wild.
The vulnerabilities, found by researchers from the CERT Polska, are located in various firmware components, including the SSH server and client, the bandwidth-test service, the X.509 certificate handling code, and the WebFig interface.
“In recent days we have been observing attacks against RouterOS devices accessible from the internet,” the Polish CERT team said in a report. “We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks.”
MikroTik released patches in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21 and advises against enabling the SSH service on the internet interface. Despite this not being the default configuration, over 122,500 MikroTik devices have SSH reachable from the internet according to scans performed by the Shadowserver Foundation, with the highest numbers in Brazil, the US, and Indonesia.
Based in Latvia, MikroTik makes routers, switches, and other networking devices for a wide range of customers, from small businesses to large enterprises. Its products are used across many sectors, including telecommunications, education, and government.
“If you have manually opened this port [SSH], make sure only trusted IP can access it, or better yet, use a strong VPN like WireGuard to access your router and do not open any management ports at all,” the company says in its advisory. “RouterOS will check if your device has been compromised, and set it to ‘Flagged’ status if it is. This will be written in the ‘Log’ section.”
Failure in SSH key validation
The most severe flaw, tracked as CVE-2026-67276, stems from improper validation of users’ RSA public keys, a key component in SSH authentication. SSH is considered a very strong and well-reviewed protocol that relies on public-key cryptography for server and user identity validation and authentication.
Due to an implementation mistake, RouterOS does not compare the entire public key presented by a user, which makes it possible for an attacker who knows the username and the public modulus of the user’s key to craft a private key that allows them to authenticate as that user.
The privilege obtained is that of the targeted user; however, a second vulnerability (CVE-2026-86060) comes into play, allowing them to escalate the privileges to root. This stems from another SSH implementation mistake in handling usernames with special characters at the start. This allows attackers to craft usernames with full administrative privileges on the underlying OS.
Mitigation
The Flagged state mechanism added by MikroTik is an indicator that the router configuration has signs of unauthorized changes, but not which vulnerabilities was used to make them. Furthermore, the absence of this marker does not necessarily indicate that the device is safe and not vulnerable.
“We cannot rule out the existence of vulnerabilities unknown to us that the vendor did not describe in the changelog,” the CERT Polska Team said. “The ‘Flagged’ marker for compromised devices should therefore be treated as an indication of a possible earlier compromise, not as proof that one of the vulnerabilities reported by CERT Polska was exploited.”
If a device does have the Flagged marker, it should be immediately isolated, it’s configuration and logs should be saved, and then it should be reset to factory defaults and reconfigured from a clean file. All keys and passwords used on the device should be rotated.
If the security updates cannot be applied immediately, users should disable or block access to the SSH, WWW/WWW-SSL, and the bandwidth-test server from untrusted networks.
“Do not initiate TLS connections from an unpatched device or use the built-in SSH clients (/system ssh and /system ssh-exec), especially when communication passes through untrusted networks or is directed at untrusted hosts,” the researchers said.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.csoonline.com/article/4220390/mikrotik-patches-flaws-currently-being-exploited-to-take-over-routers.html