MikroTik Patches Critical Flaws Chained to Hack Routers
MikroTik patches six RouterOS flaws; two chained as MikroTrick are actively exploited via SSH to fully compromise exposed routers.
MikroTik released patches for six RouterOS vulnerabilities, including actively exploited MikroTrick chain: CVE-2026-67276 (9.2, SSH auth bypass) and CVE-2026-86060 (9.2, privilege manipulation), plus CVE-2026-67277 (8.8). CERT Poland confirms exploitation since September 2, creating an 'ops' account from IPs 82.192.72.4 and 103.102.31.18. Fixed in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21; Shadowserver found 120,000+ SSH-exposed MikroTik devices.
- MikroTrick chain bypasses SSH authentication and takes full control of internet-exposed routers.
- Exploitation confirmed by CERT Poland since September 2; attackers create account named 'ops'.
- Fixed versions: RouterOS 7.25beta3, 7.24.2, 7.23.4, 6.49.21; SSH should be blocked from untrusted sources.
- Additional flaws fixed: CVE-2026-67278, CVE-2026-67279, CVE-2026-67281.
- Shadowserver found over 120,000 MikroTik devices with SSH exposed to the internet.
- Vendors
- MikroTik
- Products
- RouterOS
- Organizations
- MikroTikCERT PolandShadowserver Foundation
- Countries
- Poland
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86060 | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 group max | 6% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.102.31.18 | n originating from two IP addresses, namely 82.192.72.4 and 103.102.31.18. “The presence of any of these artifacts indicates an attem |
| ipv4 | 82.192.72.4 | attacks have been originating from two IP addresses, namely 82.192.72.4 and 103.102.31.18. “The presence of any of these artifacts |
From the original article
2 min read at securityweek.com
Dubbed MikroTrick, the bugs allow attackers to bypass authentication, overwrite configuration files, and take over devices. The post MikroTik Patches Critical Flaws Chained to Hack Routers appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.