Story · 1 source · 1 articlefirst Sep 8, 14:08 UTCupdated Sep 8, 14:08 UTC (7d ago)

MikroTik RouterOS flaws, including the exploited 'MikroTrick' SSH takeover chain, added to CISA KEV catalog

highExploit / PoCexploited in the wildimportance 82CVE-2026-67276 CVE-2026-86060 CVE-2026-67277

What's new: Story escalated over four days: Canada's Cyber Centre first flagged the three vulnerabilities as exploited in the wild on September 8 (AV26-887); CSO Online detailed the MikroTrick takeover chain and Shadowserver's 122,500+ exposed-device count on September 9; the Cyber Centre's AL26-020 and CISA's KEV addition of CVE-2026-67277 and CVE-2026-86060 followed on September 10; and GBHackers reported…

Merged summary · glm-5.3 · rewritten as coverage arrives

Attackers are exploiting three MikroTik RouterOS vulnerabilities — CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060 — with the 'MikroTrick' chain (CVE-2026-67276 + CVE-2026-86060) enabling unauthenticated full router takeover; CISA added two of them to its…

MikroTik has patched six RouterOS vulnerabilities found by CERT Polska — affecting the SSH server/client, bandwidth-test (btest) service, X.509 handling, and WebFig — in RouterOS 6.49.21, 7.23.4 (Long-Term), 7.24.2 (Stable), and 7.25 beta 3. Three of the flaws are being exploited in the wild: CVE-2026-67276, an improper cryptographic signature verification flaw (CWE-347) in the SSH server's RSA public-key validation that lets an attacker who knows a username and key modulus forge signatures and open an SSH command channel as the target user without the private key; CVE-2026-67277, a missing-authentication flaw (CWE-306) in the btest service enabling sensitive information disclosure, kernel memory exposure, and denial of service; and CVE-2026-86060, an argument injection flaw (CWE-88) exploiting special-character username handling and RouterOS policy-mask tampering to escalate privileges to root. CERT Polska confirmed attackers are chaining CVE-2026-67276 and CVE-2026-86060 (dubbed 'MikroTrick') to take full control of RouterOS devices with SSH exposed to the internet; Shadowserver Foundation scans show over 122,500 such devices, concentrated in Brazil, the US, and Indonesia. On September 10, 2026, CISA added CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 13 to apply mitigations, and designated CVE-2026-86060 as requiring forensic triage under Binding Operational Directive 26-04. Canada's Cyber Centre issued advisories AV26-887 (September 8) and AL26-020 (September 10) urging immediate updates, prioritization of internet-exposed SSH systems, and log review. MikroTik's 'Flagged' status signals possible compromise but does not guarantee a device is clean; recommended mitigations include restricting SSH to trusted IPs or VPN, disabling SSH/WWW/bandwidth-test, rotating keys and passwords, and isolating, backing up, factory resetting, and reconfiguring compromised devices from a clean file.

Three exploited-in-the-wild CVEs: CVE-2026-67276 (CWE-347, SSH RSA public-key validation/signature forgery), CVE-2026-67277 (CWE-306, missing authentication in btest service enabling kernel memory exposure and DoS), CVE-2026-86060 (CWE-88,…
The 'MikroTrick' chain combines CVE-2026-67276 and CVE-2026-86060 for unauthenticated full router takeover of SSH-exposed devices; confirmed exploited by CERT Polska.
Six total RouterOS vulnerabilities found by CERT Polska were patched, affecting the SSH server/client, bandwidth-test service, X.509 handling, and WebFig.
Fixed versions: RouterOS 6.49.21, 7.23.4 (Long-Term), 7.24.2 (Stable), and 7.25 beta 3.
CISA added CVE-2026-67277 and CVE-2026-86060 to its KEV catalog on September 10, 2026, with a September 13 mitigation deadline for federal agencies; CVE-2026-86060 requires forensic triage under Binding Operational Directive 26-04.
Shadowserver Foundation scans show over 122,500 devices with internet-reachable SSH, concentrated in Brazil, the US, and Indonesia.
Canadian Centre for Cyber Security advisories: AV26-887 (September 8, 2026) and AL26-020 (September 10, 2026).
MikroTik's 'Flagged' status signals possible compromise but does not guarantee a device is clean; compromised routers could show altered routing rules, persistence, traffic interception, or use as pivots into internal networks.

VendorsMikroTik CISA Cisco

ProductsRouterOS

OrganizationsCERT Polska Shadowserver Foundation Canadian Centre for Cyber Security CISA

CountriesBrazil United States Indonesia Canada Poland

Coverage timelineoldest first · each row is one article

Sep 8, 14:08 UTC · 7d ago
Canadian Centre for Cyber Security· 70
Mikrotik security advisory (AV26-887)
Canada's Cyber Centre urges MikroTik RouterOS updates as CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060 are reported exploited in the wild.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-67276	SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x MikroTik RouterOS 7.x fails to compare the complete RSA public key when matching an SSH authentication attempt against an authorized user key, checking the key type and modulus but omitting the exponent. Because RouterOS verifies the signature against the client-supplied key, an attacker who knows the modulus of an authorized RSA key can present a key with exponent 1 and a forged signature and be accepted as that user without possessing the private key. Successful exploitation opens an SSH command channel as the target user, giving the attacker control of the router without a password or key. Only the RouterOS 7.x branch is affected, with fixes released in 7.23.4 (Long-term) and 7.24.2 (Stable). A public proof-of-concept is available and related reporting describes active campaigns hijacking MikroTik routers using chained RouterOS flaws, though this CVE is not in CISA KEV and its 30-day EPSS probability is low (0.2%). Do: Upgrade affected devices to RouterOS 7.23.4 (Long-term) or 7.24.2 (Stable) or later. Until patched, restrict SSH access to trusted management networks and, if feasible, remove or replace RSA authorized keys with other key types. Check devices for signs of compromise highlighted in recent reporting, such as an unexpected SSH user named '-2'.	9.2	<1%		MikroTik RouterOS 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable)	mass~1M RouterOS 7.x devices (installed base in the millions; hundreds of thousands internet-exposed, with SSH a standard management service)	10d ago
CVE-2026-86060 +1 in the same advisory: …67277	Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV. Do: Upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as applicable. Until patched, restrict SSH (TCP 22) to trusted management networks or disable the SSH service if unused, and review authentication logs and user/group policy settings for tampering — reports indicate attackers log in with usernames beginning with '-' (e.g., '-2').	9.2 group max	1%	KEV PoC ×2	MikroTik RouterOS v6 (Long-term channel) versions prior to 6.49.21 (fixed in 6.49.21) MikroTik RouterOS v7 (Long-term channel) versions prior to 7.23.4 (fixed in 7.23.4) MikroTik RouterOS v7 (Stable channel) versions prior to 7.24.2 (fixed in 7.24.2)	mass≈1M+ devices: hundreds of thousands to over a million RouterOS devices are routinely observed internet-exposed, and far more expose SSH to the LAN	10d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-67276

SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x

MikroTik RouterOS 7.x fails to compare the complete RSA public key when matching an SSH authentication attempt against an authorized user key, checking the key type and modulus but omitting the exponent. Because RouterOS verifies the signature against the client-supplied key, an attacker who knows the modulus of an authorized RSA key can present a key with exponent 1 and a forged signature and be accepted as that user without possessing the private key. Successful exploitation opens an SSH command channel as the target user, giving the attacker control of the router without a password or key. Only the RouterOS 7.x branch is affected, with fixes released in 7.23.4 (Long-term) and 7.24.2 (Stable). A public proof-of-concept is available and related reporting describes active campaigns hijacking MikroTik routers using chained RouterOS flaws, though this CVE is not in CISA KEV and its 30-day EPSS probability is low (0.2%).

Do: Upgrade affected devices to RouterOS 7.23.4 (Long-term) or 7.24.2 (Stable) or later. Until patched, restrict SSH access to trusted management networks and, if feasible, remove or replace RSA authorized keys with other key types. Check devices for signs of compromise highlighted in recent reporting, such as an unexpected SSH user named '-2'.

9.2

<1%

MikroTik RouterOS 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable)

mass~1M RouterOS 7.x devices (installed base in the millions; hundreds of thousands internet-exposed, with SSH a standard management service)

10d ago

CVE-2026-86060

+1 in the same advisory: …67277

Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation

CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV.

Do: Upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as applicable. Until patched, restrict SSH (TCP 22) to trusted management networks or disable the SSH service if unused, and review authentication logs and user/group policy settings for tampering — reports indicate attackers log in with usernames beginning with '-' (e.g., '-2').

9.2

group max

KEV PoC ×2

MikroTik RouterOS v6 (Long-term channel) versions prior to 6.49.21 (fixed in 6.49.21)
MikroTik RouterOS v7 (Long-term channel) versions prior to 7.23.4 (fixed in 7.23.4)
MikroTik RouterOS v7 (Stable channel) versions prior to 7.24.2 (fixed in 7.24.2)

mass≈1M+ devices: hundreds of thousands to over a million RouterOS devices are routinely observed internet-exposed, and far more expose SSH to the LAN

10d ago