MikroTik RouterOS 'MikroTrick' SSH Chain Exploited Before Vendor Advisory Landed

On 5 September 2026 CERT Polska published six vulnerabilities it found in MikroTik RouterOS, the operating system that runs on millions of MikroTik routers, switches and wireless devices. Two of them combine into an unauthenticated takeover chain the team named MikroTrick, and it is not theoretical: CERT Polska says attackers have been using it against internet-facing devices since at least 2 September, three days before the advisory and two days after MikroTik quietly shipped the fixes. If you run RouterOS anywhere with SSH reachable from an untrusted network, treat this as an active incident, not a patchPatch🛡️A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program.-when-convenient item.

What happened

MikroTik released fixed builds across every channel on 3 September 2026: 6.49.21 and 7.23.4 on the long-term branch, 7.24.2 on stable, and 7.25beta3 on development. The vendor's notice said only that it had found "a security vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. in RouterOS," that "most configurations are not at risk," and that upgrading was "highly recommended." It withheld technical detail deliberately, to give operators time to patch before the flaws were understood.

That embargo did not hold. Patched binaries are public the moment they ship, and by 4 September the independent researcher Nick Pratley had diffed the 7.23.3 and 7.23.4 builds and published a detailed analysis of what changed. CERT Polska, whose researcher Sławomir Rozbicki reported the flaws, released the full advisory and CVE records on 5 September. By then the attacks were already running.

The six flaws, and the two that matterMatter🏠A new universal smart home standard backed by Apple, Google, and Amazon for cross-platform compatibility. most

CERT Polska assigned six CVEs. The two rated critical are both in the SSH path and both scored 9.2. The first, CVE-2026-67276, is an SSH authentication bypassAuthentication Bypass📖A security vulnerability that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials.. RouterOS did not compare the complete RSA public key when matching an incoming key to an authorized user; it checked the key type and modulus but ignored the exponent. An attacker who knows an authorized RSA modulus can present a key with exponent one, forge a valid signature, and open a command channel as that user without ever holding the private key.

The second, CVE-2026-86060, is a privilege escalationPrivilege Escalation🛡️An attack technique where an adversary gains elevated access rights beyond what was initially granted. through argument injectionArgument Injection🛡️A flaw (CWE-88) in which attacker-controlled input is passed into a command or program as arguments without neutralizing delimiters, so a value such as a username beginning with a dash is interpreted as an option rather than data. In RouterOS this allowed privilege escalation via a crafted SSH username (CVE-2026-86060).. RouterOS mishandled SSH usernames that begin with a prohibited character, letting an attacker overwrite the trusted RouterOS policy mask and lift a session to full administrative rights. Chained together as MikroTrick, the pair turns an exposed SSH port into full device control.

The remaining four are serious in their own right. CVE-2026-67279 (CVSS 6.9) lets an unauthenticated client slip past authentication by requesting a key re-exchange, then open a session channel and touch the RouterOS file namespace. CVE-2026-67277 (8.8) lets an unauthenticated attacker read leftover kernel buffer data and crash the device through the bandwidthBandwidth🌐Maximum data transfer rate of a network connection, measured in Mbps or Gbps.-test service. CVE-2026-67281 (8.7) is an unauthenticated file read in WebFig that reaches root-owned files and credential stores. CVE-2026-67278 (6.3) lets a network attacker forge trusted TLS certificates because RouterOS accepts malformed PKCS#1 v1.5 signatures and ships an e=3 root CA, enabling server impersonation against outbound connections from the device.

Who is affected

Every RouterOS 6.x below 6.49.21, every 7.x below 7.23.4, and 7.24 through 7.24.1 is vulnerable. That is an enormous installed base. MikroTik hardware is a default choice for wireless internet providers, small and mid-size businesses, labs and home networks, and the devices are notorious for being deployed once and forgotten. The critical chain only fires when SSH is reachable, but MikroTik's own guidance is a reminder of how often that is the case: the company urged operators to keep Winbox, WebFig and SSH off the public internet and behind a VPN, which it would not need to say if the practice were rare.

How the attacks look

CERT Polska's telemetry attributes the confirmed intrusions, including creation of a highly privileged account named "ops", to the source address 82.192.72.4, active since at least 2 September. The tell in the logs is a login attempt for the literal user "-2" followed by an account-creation entry that credits the session as ssh:-2 at the attacker's address. In RouterOS log form it reads as a failed login for user -2 over ssh, immediately followed by a new user added by ssh:-2 from the same IP.

Pratley's reversing corroborates the same pattern and adds attacker infrastructure baked into RouterOS's own cleanup logic: the patched builds recognize an "ops" user in the full group and the domains mythtime.xyz, leappoach.info and eeongous.com used in fetch and scheduler entries, disable that configuration, and put the device into a flagged state on next boot. Understanding how a server can be walked past its own login prompt is worth the detour, and our explainer on how SSH servers get tricked into skipping authentication walks through the exact class of protocol and signature bugs behind CVE-2026-67276 and CVE-2026-67279.

Immediate actions

Patch first. Upgrade to 6.49.21, 7.23.4 (or the 7.23.5 long-term build that followed on 4 September) or 7.24.2, matching your current channel. After the upgrade RouterOS inspects the configuration and sets a flagged state if it sees signs of tampering; check it with the device-mode print command, and, critically, do not clear the flag until you have audited the whole configuration by hand.

If SSH, WebFig or the bandwidth-test service is exposed and you cannot patch immediately, take those services off any untrusted network now. Because CVE-2026-67278 lets an attacker impersonate TLS endpoints, avoid initiating TLS connections or using the built-in SSH client from an unpatched device. Our guide on how to lock down MikroTik RouterOS management access covers the service, firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. and account settings that keep the management planeManagement Plane🌐The interfaces and services used to configure and administer a device, as distinct from the data plane that carries user traffic. On a remote-access appliance the management plane is the admin console; exposing it to the internet or to the user-facing portal is a common root cause of privileged compromise. private, and pairs well with the existing walkthrough on how to restrict a web admin interface to trusted IP addresses.

Treat any device that shows the -2 log signature, an unexplained "ops" account, or a flagged state as compromised. CERT Polska's recovery guidance is unambiguous: isolate the device, preserve its logs and configuration for analysis, restore to factory settings, rebuild from a known-good configuration, and rotate every password, key and secret the device held. A firmwareFirmware🏠Permanent software programmed into a device's hardware that controls its basic functions. update does not evict an attacker who already created accounts and scheduled tasks.

Long-term outlook

MikroTik devices have been conscripted into botnets before, from VPNFilter to Mēris, precisely because they are numerous, powerful, long-lived and rarely watched. A pre-authentication SSH chain against that population is exactly the raw material a botnetBotnet🛡️A network of internet-connected devices compromised and controlled by an operator, used for denial-of-service attacks, proxying malicious traffic, credential stuffing or spam. Edge routers are prized botnet hosts because they are numerous, always on, directly reachable and rarely inspected by their owners. operator wants, and the three-day head start between silent patch and public advisory guarantees a tail of compromised devices that will outlast the news cycle. Planning for that reality, the standing botnet risk that unpatched edge routers represent, is a strategic problem distinct from any single CVE, and one worth reading our piece on why edge routers become a standing botnet risk before your next hardware refresh. The pattern of repeat zero-days in remote-access gear that we covered around recent VPN-appliance advisories applies here too.

Sources

• https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
• https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/
• https://mikrotik.com/supportsec/september-2026-vulnerability/
• https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
• https://cveawg.mitre.org/api/cve/CVE-2026-67276
• https://cveawg.mitre.org/api/cve/CVE-2026-86060
• https://cveawg.mitre.org/api/cve/CVE-2026-67279
• https://cveawg.mitre.org/api/cve/CVE-2026-67277
• https://cveawg.mitre.org/api/cve/CVE-2026-67281
• https://cveawg.mitre.org/api/cve/CVE-2026-67278
• https://cert.gov.lv/lv/2026/09/uzbruceji-pastiprinati-censas-kompromitet-mikrotik-marsrutetajus
• https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html