Critical MikroTik Vulnerability - Patch Now, (Sun, Sep 6th)
MikroTik patched a critical SSH authentication bypass already exploited in the wild; attackers add accounts to affected routers for post-patch persistence.
MikroTik released a patch late last week for a critical vulnerability allowing SSH authentication bypass that is already being exploited in the wild, per the vendor's September 2026 advisory. Attackers have been adding new accounts to affected devices to maintain access even after the patch is installed. The patch attempts to detect compromise and set a 'Flagged' status on affected devices, and SANS ISC advises administrators to assume compromise.
- Exploited flaw allows SSH authentication bypass on MikroTik devices.
- Attackers create new accounts for persistence that survives patching.
- September 2026 patch attempts compromise detection and sets a 'Flagged' status.
- SANS ISC urges administrators to assume compromise and review affected devices.
- Vendors
- MikroTik
- Products
- RouterOS
- Organizations
- SANS Internet Storm Center
From the original article
1 min read at isc.sans.eduMikrotik released a patch late last week for an already-exploited vulnerability. The vulnerability allows an SSH authentication bypass and is already being exploited. At this point, assume compromise.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.