CERT Polska has disclosed a chain of MikroTik RouterOS vulnerabilities, dubbed MikroTrick, that lets an unauthenticated attacker with only network access to a device’s SSH service obtain full administrative control. Exploitation began at least as early as September 2, 2026 — a day before MikroTik shipped patched builds — and the Shadowserver Foundation counted roughly 122,500 RouterOS devices with SSH reachable from the public internet in a single 24-hour scan window on September 5.

What happened

CERT Polska’s coordinated disclosure covers six distinct RouterOS vulnerabilities, two of which chain into MikroTrick. Researchers say they found the bugs only after observing live attacks against RouterOS devices, meaning this was caught as an in-the-wild zero-day rather than through proactive research.

Technical details

The core chain is two bugs, each rated CVSS 9.2:

  • CVE-2026-67276 — SSH public-key authentication bypass. RouterOS validates an incoming SSH client’s RSA public key against the key on file for the target user, but the check only compares the key type and modulus — it never verifies the exponent. An attacker who already knows (or can obtain, e.g. from a leaked authorized_keys file or prior reconnaissance) the modulus of an authorized RSA key can construct their own keypair using exponent e=1, forge a valid-looking signature, and open an authenticated SSH command channel as that user without ever holding the real private key.
  • CVE-2026-86060 — privilege escalation via malformed username. Once a session is open, RouterOS mishandles SSH usernames that begin with a disallowed character. A specially crafted username causes the device to apply the policy mask for a full administrator instead of the restricted session that should result, handing the attacker unrestricted RouterOS admin rights.

Chained together, an attacker needs no credentials, no private key, and no prior admin account — only that SSH is reachable from where they sit.

CERT Polska’s disclosure also covers four related flaws: CVE-2026-67277 (CVSS 8.8, a pre-auth btest race/integer underflow that can crash and restart the RouterOS kernel), CVE-2026-67278 (acceptance of malformed RSA/PKCS#1 v1.5 signatures during X.509 validation, combined with a weak e=3 root CA in RouterOS’s trust store, letting an attacker forge certificates for arbitrary hostnames), CVE-2026-67279 (CVSS 6.9, a pre-auth SSH rekey-state bypass allowing file creation/overwrite in RouterOS’s managed file namespace), and CVE-2026-67281.

Affected: RouterOS 6.x, 7.x branches prior to the patched builds below Patched in: 6.49.21 (long-term), 7.23.4 (long-term), 7.24.2 (stable), 7.25beta3 Attack vector: Network, unauthenticated, requires SSH exposed to the attacker Disclosed by: CERT Polska (CERT.PL), coordinated disclosure, September 2026 First observed exploitation: September 2, 2026 — one day before patches were released

Indicators of compromise

Defenders should look for:

  • SSH login attempts or session logs referencing username -2 (e.g., history entries like ssh:-2@<ip>)
  • An unexpected ops user account, particularly one created by another anomalous account
  • Source IP addresses 82.192.72.4 and 103.102.31.18, observed in confirmed exploitation attempts
  • Unexplained changes to firewall rules or new SSH keys added to /user or /ip ssh configuration following a session from an unrecognized account

Impact

Any RouterOS device with SSH exposed to the internet or an untrusted network segment is a target — and MikroTik hardware sits disproportionately at network edges, ISPs, and small-to-midsize business perimeters where it routes and firewalls everything behind it. Full admin access means an attacker can rewrite firewall rules, pivot into the internal network, intercept or redirect traffic, add persistent backdoor accounts, or recruit the device into a botnet. Given the 122,500 SSH-exposed devices Shadowserver found in a single scan, and that exploitation predates the patch by at least a day, a meaningful fraction of that population should be assumed potentially compromised until checked.

Mitigation

  1. Patch immediately to RouterOS 6.49.21, 7.23.4, or 7.24.2 depending on your branch.
  2. Remove SSH from the internet-facing side. Restrict SSH access to a management VPN or trusted internal ranges via firewall rules — MikroTrick requires network reachability to the SSH service, so eliminating that exposure closes the door even before patching.
  3. Audit for the IOCs above — check user lists for an ops account or other unrecognized users, review SSH and system logs for the -2 username pattern, and check for connections from the two IPs listed.
  4. Rotate credentials and keys on any device that shows signs of compromise, and treat its prior configuration as untrusted — reset firewall and NAT rules from a known-good backup rather than trusting the live config.
  5. Re-scan your fleet after patching; Shadowserver and similar internet-wide scanners are actively tracking exposed RouterOS SSH instances and can help confirm remediation.

References