MikroTrick: the SSH flaw letting attackers own MikroTik routers without a password
MikroTrick: the SSH flaw letting attackers own MikroTik routers without a password
Section titled “MikroTrick: the SSH flaw letting attackers own MikroTik routers without a password”Attackers are taking over MikroTik routers with no password at all. Poland’s CERT agency (CERT Polska) confirmed that a chain of two RouterOS flaws, named MikroTrick, is being exploited against devices whose SSH service is reachable from the public internet (BleepingComputer). Exploitation began around September 2, one day before MikroTik shipped patched builds on September 3 (SOCPrime). On September 10, CISA added both CVEs to its Known Exploited Vulnerabilities catalog (Decryption Digest). If you run MikroTik gear, this is the story to act on today.
The chain: two flaws, one takeover
Section titled “The chain: two flaws, one takeover”CERT Polska disclosed six RouterOS vulnerabilities on September 5 (eSecurityPlanet). Two of them chain together to hand an attacker full administrative control.
| CVE | CVSS | What it does |
|---|---|---|
| CVE-2026-67276 | 9.2 | SSH public-key authentication bypass. RouterOS compares only the key type and RSA modulus, not the full key. An attacker who knows a username and its key’s public modulus can forge a different key and log in without the private key (SOCPrime). |
| CVE-2026-86060 | 9.2 | Privilege escalation via a specially crafted username during SSH login. The crafted username manipulates the session policy so the attacker gets full administrative privileges (BleepingComputer). |
The first flaw gets the attacker in. The second makes them an administrator (Malwarebytes). No credentials required, as long as SSH is exposed to the internet (BleepingComputer).
The other four flaws cover the bandwidth-test service, X.509 certificate validation, SSH authentication state, and the WebFig management interface (eSecurityPlanet). CERT Polska highlighted CVE-2026-67277, a bandwidth-test flaw rated CVSS 8.8, because it lets an unauthenticated attacker leak kernel memory or crash the router (BleepingComputer).
The exposed surface
Section titled “The exposed surface”CERT Polska found roughly 122,500 MikroTik devices with SSH exposed to the public internet as of September 5 (daily.dev). CERT Polska confirmed the chain in its advisory. “We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks” (BleepingComputer).
A compromised router is not just a broken box. It sits at the edge of your network. An attacker who owns it can change DNS settings, redirect or capture traffic, and create remote-access tunnels. It can also alter firewall rules or serve as a foothold to attack other hosts on the network (Malwarebytes). Those are the same capabilities a cautious defender would refuse to hand to anyone.
There is a turnaround worth noting: CERT Polska accelerated the research with OpenAI’s GPT-5.5-cyber and GPT-5.6-sol models, with human researchers directing and validating the work (BleepingComputer). AI-assisted vulnerability research is now production practice at national CERTs, and it shortens the window between disclosure and exploit (daily.dev). That window is your patch deadline, and it is getting smaller.
The fix and the checks
Section titled “The fix and the checks”MikroTik released patched builds on September 3, and CERT Polska validated them (BleepingComputer):
| Branch | Fixed version |
|---|---|
| RouterOS 6 (long-term) | 6.49.21 |
| RouterOS 7 (long-term) | 7.23.4 |
| RouterOS 7 (stable) | 7.24.2 |
| RouterOS 7 (beta) | 7.25beta3 |
MikroTik later released 7.23.5 to fix an unrelated IPv6 DHCP regression (daily.dev). The vulnerable ranges are RouterOS 6.0.0 through below 6.49.21, RouterOS 7.0.0 through below 7.23.4, and RouterOS 7.24 through below 7.24.2 (daily.dev). If you track which branch you run, the update path is short.
The patched firmware also adds a compromise-detection mechanism. At startup it looks for known signs of unauthorized configuration changes, disables malicious entries, and logs a critical warning (BleepingComputer). After updating, check /system/device-mode/print for a “Flagged” marker, and look for unknown users, scripts, or tunnels (SecureTechIn, 2026).
Rules for your fleet
Section titled “Rules for your fleet”- Do not expose SSH to the internet. MikroTik recommends closing SSH to untrusted networks and using a VPN such as WireGuard for remote administration (daily.dev). Management planes belong behind the perimeter, not on it.
- Patch the day fixes ship, not the day exploits ship. Exploitation started one day before patches existed (SOCPrime). Treat every patch as a race.
- Treat a compromised edge device as a full incident. Assume the attacker changed DNS, firewall rules, and tunnels. Rebuild or wipe the device, rotate every credential it touched, and re-check the rest of the network (Malwarebytes).
- Add network gear to your vulnerability inventory. Your CVE feed should list routers, firewalls, and switches, not just servers and containers. This chain hit devices most teams never patch automatically.
- Assume the AI-assisted disclosure cadence is the new baseline. When national CERTs use frontier models to find flaws, the gap between public disclosure and working exploit shrinks (daily.dev). Your automation must shrink with it.
The takeaway
Section titled “The takeaway”MikroTrick is the pattern for 2026: a cryptographically subtle auth bypass, a privilege escalation, and internet-exposed management ports turned into full device takeover in days. The fix is known, the versions are clear, and the checks are documented (eSecurityPlanet). The only open question is whether your fleet is already inside the exposed count. Close the port, ship the patch, and run the post-update checks. That is the whole job, and it is urgent (Decryption Digest).