networking

2 posts with the tag “networking”

MikroTrick: the SSH flaw letting attackers own MikroTik routers without a password

Sep 14, 2026

Christopher Shaun Godwin

Author

MikroTrick: the SSH flaw letting attackers own MikroTik routers without a password

Attackers are taking over MikroTik routers with no password at all. Poland’s CERT agency (CERT Polska) confirmed that a chain of two RouterOS flaws, named MikroTrick, is being exploited against devices whose SSH service is reachable from the public internet (BleepingComputer). Exploitation began around September 2, one day before MikroTik shipped patched builds on September 3 (SOCPrime). On September 10, CISA added both CVEs to its Known Exploited Vulnerabilities catalog (Decryption Digest). If you run MikroTik gear, this is the story to act on today.

The chain: two flaws, one takeover

CERT Polska disclosed six RouterOS vulnerabilities on September 5 (eSecurityPlanet). Two of them chain together to hand an attacker full administrative control.

CVE	CVSS	What it does
CVE-2026-67276	9.2	SSH public-key authentication bypass. RouterOS compares only the key type and RSA modulus, not the full key. An attacker who knows a username and its key’s public modulus can forge a different key and log in without the private key (SOCPrime).
CVE-2026-86060	9.2	Privilege escalation via a specially crafted username during SSH login. The crafted username manipulates the session policy so the attacker gets full administrative privileges (BleepingComputer).

The first flaw gets the attacker in. The second makes them an administrator (Malwarebytes). No credentials required, as long as SSH is exposed to the internet (BleepingComputer).

The other four flaws cover the bandwidth-test service, X.509 certificate validation, SSH authentication state, and the WebFig management interface (eSecurityPlanet). CERT Polska highlighted CVE-2026-67277, a bandwidth-test flaw rated CVSS 8.8, because it lets an unauthenticated attacker leak kernel memory or crash the router (BleepingComputer).

The exposed surface

CERT Polska found roughly 122,500 MikroTik devices with SSH exposed to the public internet as of September 5 (daily.dev). CERT Polska confirmed the chain in its advisory. “We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks” (BleepingComputer).

A compromised router is not just a broken box. It sits at the edge of your network. An attacker who owns it can change DNS settings, redirect or capture traffic, and create remote-access tunnels. It can also alter firewall rules or serve as a foothold to attack other hosts on the network (Malwarebytes). Those are the same capabilities a cautious defender would refuse to hand to anyone.

There is a turnaround worth noting: CERT Polska accelerated the research with OpenAI’s GPT-5.5-cyber and GPT-5.6-sol models, with human researchers directing and validating the work (BleepingComputer). AI-assisted vulnerability research is now production practice at national CERTs, and it shortens the window between disclosure and exploit (daily.dev). That window is your patch deadline, and it is getting smaller.

The fix and the checks

MikroTik released patched builds on September 3, and CERT Polska validated them (BleepingComputer):

Branch	Fixed version
RouterOS 6 (long-term)	6.49.21
RouterOS 7 (long-term)	7.23.4
RouterOS 7 (stable)	7.24.2
RouterOS 7 (beta)	7.25beta3

MikroTik later released 7.23.5 to fix an unrelated IPv6 DHCP regression (daily.dev). The vulnerable ranges are RouterOS 6.0.0 through below 6.49.21, RouterOS 7.0.0 through below 7.23.4, and RouterOS 7.24 through below 7.24.2 (daily.dev). If you track which branch you run, the update path is short.

The patched firmware also adds a compromise-detection mechanism. At startup it looks for known signs of unauthorized configuration changes, disables malicious entries, and logs a critical warning (BleepingComputer). After updating, check /system/device-mode/print for a “Flagged” marker, and look for unknown users, scripts, or tunnels (SecureTechIn, 2026).

Rules for your fleet

1. Do not expose SSH to the internet. MikroTik recommends closing SSH to untrusted networks and using a VPN such as WireGuard for remote administration (daily.dev). Management planes belong behind the perimeter, not on it.
2. Patch the day fixes ship, not the day exploits ship. Exploitation started one day before patches existed (SOCPrime). Treat every patch as a race.
3. Treat a compromised edge device as a full incident. Assume the attacker changed DNS, firewall rules, and tunnels. Rebuild or wipe the device, rotate every credential it touched, and re-check the rest of the network (Malwarebytes).
4. Add network gear to your vulnerability inventory. Your CVE feed should list routers, firewalls, and switches, not just servers and containers. This chain hit devices most teams never patch automatically.
5. Assume the AI-assisted disclosure cadence is the new baseline. When national CERTs use frontier models to find flaws, the gap between public disclosure and working exploit shrinks (daily.dev). Your automation must shrink with it.

The takeaway

MikroTrick is the pattern for 2026: a cryptographically subtle auth bypass, a privilege escalation, and internet-exposed management ports turned into full device takeover in days. The fix is known, the versions are clear, and the checks are documented (eSecurityPlanet). The only open question is whether your fleet is already inside the exposed count. Close the port, ship the patch, and run the post-update checks. That is the whole job, and it is urgent (Decryption Digest).

Tags:

• devops
• security
• networking

Cisco FMC CVSS 10.0 bypass is exploited in the wild: Sandworm and ransomware crews are in

Sep 11, 2026

Christopher Shaun Godwin

Author

Cisco FMC CVSS 10.0 bypass is exploited: take the management plane off the internet

The device that configures every firewall on your network is itself compromised. On September 9, Cisco Talos said three threat crews are actively exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center (FMC) (Cisco Talos). The crews run a web shell, a Java command executor, Sandworm’s Cyclops Blink, and Qilin ransomware through the same console (BleepingComputer). This is not a theory. This is the management plane of your firewall fleet, hit where it cannot defend itself.

The bug: a login that never gets claimed

CVE-2026-20079 lets an unauthenticated remote attacker bypass login controls entirely (Cisco Talos). The flaw starts in a system process created when the FMC boots. If no legitimate user claims the resulting session, an attacker can hijack it and walk in as that user (Cyber Security News).

Cisco disclosed the flaw on March 4, 2026 (SOCRadar). Cisco released fixes on July 29, 2026 for customer-managed FMC (BleepingComputer). Security teams have had weeks to patch. Cisco said in August its team became aware of active exploitation, while indicators in a July advisory point to activity on July 23 (BleepingComputer).

The second bug, CVE-2026-20316, is a static credential issue with a CVSS score of 5.3. Alone it offers limited access. Chained with the bypass, it helps an attacker climb to full control (Cyber Security News). CISA added it to the Known Exploited Vulnerabilities catalog in late July 2026 (The Hacker News).

Three crews, one console

Talos tracks three attack clusters in the same management plane (Cisco Talos).

1. UAT-12197: web shell plus credential theft. They plant a JSP web shell inside the FMC Tomcat webroot, then drop an executable archive command executor named cmd.jar (Cyber Security News). The chain sips authentication data and credentials from the compromised box.

2. UAT-11823: Sandworm (GRU Unit 74455). The Russian state group swaps the license file for a malicious copy, then executes it as root through the legitimate package_info.pl utility. The file is actually a Makeself package that sets up a Netcat-based reverse shell to its command-and-control server (Cisco Talos). It collects configuration data from every managed firewall into archives, then installs a modular Linux implant: Cyclops Blink, the family US and UK agencies previously tied to Sandworm (Cisco Talos). This variant persists through init directories, resolves its command server through DNS over HTTPS, and harvests credentials (Cisco Talos).

3. UAT-11988: Qilin ransomware. A third crew logs in with the static credentials from CVE-2026-20316, maps the environment, steals more credentials, and builds the target list it will later encrypt (Cisco Talos). It then deploys the Qilin ransomware family across the fleet (The Hacker News).

One console controls every firewall rule, every VPN policy, every network access boundary on the fleet (SecurityWeek). Whoever sits in FMC does not break one firewall. They get to re-draw the whole network’s rule base.

Why this matters to DevOps

FMC is the single place your firewall rules are pushed from. A compromise there does not just read secrets. It can modify the rules the whole perimeter enforces (Alvaka). An attacker can add their own rules, delete yours, or hand your wire directly to their callbacks.

FCEB agencies must patch known exploited FMC before September 12, 2026, per CISA’s KEV catalog (BleepingComputer). CVE-2026-20079 is the third FMC vulnerability CISA added to KEV in 2026, so this family of flaws keeps drawing attackers (SecurityWeek). No work-around fully covers the issue. The only fix is the patch (SOCRadar).

The fix and the takeaways

Cisco has hot fixes for every supported release branch, including 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 (SOCRadar). Apply them. This is the only full fix.

1.Patch FMC this week. Apply the hotfix to every FMC instance, even isolated ones. The attacker does not care about your change window (Help Net Security). 2.Pull the management interface off the public internet. Restricting which networks can reach FMC materially reduces the chance of exploitation (SecurityWeek). FMC never needs to be a public endpoint. 3.Treat Friday’s date as the industry floor. Even if you are not federal, apply the KEV deadline to your own fleet (BleepingComputer). 4.Sweep for the artifacts. Look for a JSP web shell in the Tomcat webroot, a cmd.jar executable, a tampered license file, and a Netcat-based reverse shell spawned via the package utility (Cyber Security News). 5.Reset the admin credential chain. Assume sessions. Rotate FMC admin accounts, change static credentials, and check every identity provider that can log in to it (Cyber Security News). 6.Audit the managed config. Export every firewall policy and diff it against the last known-good baseline. A rule you did not write lives somewhere (Help Net Security).

Bottom line

A perfect 10.0 bug in your firewall control plane is being actively exploited by three crews today. Sandworm’s implant and Qilin ransomware both route through FMC. The fix has existed since July and the CISA deadline lands tomorrow. Patch the box, and take the management console itself off the internet (Cisco Talos).

Tags:

• security
• devops
• networking
• cve