Hackers exploit new MikroTik RouterOS flaws to hijack routers
Attackers actively exploit a MikroTik RouterOS SSH authentication bypass and privilege escalation chain, dubbed MikroTrick, to fully hijack internet-exposed routers.
Poland's CERT, with help from GPT-5.5-cyber and GPT-5.6-sol, discovered and confirmed active exploitation of a MikroTik RouterOS chain dubbed MikroTrick: SSH authentication bypass CVE-2026-67276 (incomplete RSA public key validation) chained with privilege escalation CVE-2026-86060 (crafted usernames granting full administrative privileges). A third flaw, CVE-2026-67277, allows unauthenticated kernel memory leaks or router crashes via the bandwidth-test service. Fixes shipped September 3 in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, adding a startup compromise-detection mechanism. Shadowserver data showed 122,500 MikroTik devices with exposed SSH interfaces as of September 5, and the CERT published IoCs including two attacker IP addresses.
- CVE-2026-67276 allows SSH login without the private key when the public modulus is known
- CVE-2026-86060 grants full administrative privileges via specially crafted usernames
- CVE-2026-67277 lets unauthenticated attackers leak kernel memory or crash routers via the bandwidth-test service
- Fixed in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21 on September 3; ~122,500 devices had exposed SSH
- IoCs include specific SSH log entries, a privileged ops account, and IPs 82.192.72.4 and 103.102.31.18
- Vendors
- MikroTik
- Products
- RouterOSMikroTik routers
- Organizations
- MikroTikCERT PolskaShadowServer Foundation
- Countries
- Poland
- AI models
- GPT-5.5-cyberGPT-5.6-sol
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86060+2 related CVEs | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 group max | 6% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.102.31.18 | ccount 82.192.72.4 — linked to confirmed successful attacks 103.102.31.18 — observed attempting to exploit MikroTrick If compromise i |
| ipv4 | 82.192.72.4 | by ssh:-2@<ip>’ Presence of a highly privileged ops account 82.192.72.4 — linked to confirmed successful attacks 103.102.31.18 — ob |
From the original article
2 min read at bleepingcomputer.com
Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.