MikroTik RouterOS Attack Chain Hijacks Devices

Threat actors are actively exploiting a chain of two critical vulnerabilities in MikroTik routers. The attack, dubbed “MikroTrick,” allows hackers to bypass SSH authentication and escalate privileges to gain full administrative control of internet-exposed devices.

Over 122,500 MikroTik routers with SSH exposed are at risk. Patches are available, but defenders must act quickly to prevent compromise.

What Happened: MikroTrick Attack Chain Exploits MikroTik RouterOS Flaws

On September 3, 2026, MikroTik released security updates for RouterOS after Poland’s CERT agency discovered an active exploitation campaign. The campaign chains two vulnerabilities to hijack routers without requiring the victim’s private SSH key.

The first flaw is CVE-2026-67276. It is an SSH authentication bypass caused by incomplete validation of RSA public keys. An attacker who knows a username and the public modulus of that user’s key can craft a different key and log in successfully. Consequently, the attacker does not need the legitimate private key to authenticate.

The second flaw is CVE-2026-86060. It is an SSH privilege escalation issue caused by improper handling of specially crafted usernames. Hackers can manipulate the SSH session to obtain full administrative privileges. When combined, these flaws allow complete device takeover.

Poland’s CERT named the exploit chain “MikroTrick” and confirmed active exploitation in the wild. In recent days, attackers have been observed scanning for and compromising RouterOS devices accessible from the internet. Moreover, the CERT obtained confirmation that the attackers are exploiting the full chain to take control of affected devices.

Technical Details of the MikroTik RouterOS Vulnerability Chain

The MikroTrick attack chain relies on two distinct but complementary flaws in RouterOS SSH handling. Both were discovered by Poland’s CERT with assistance from GPT-5.5-cyber and GPT-5.6-sol and rated critical severity.

CVE-2026-67276: SSH Authentication Bypass

This vulnerability stems from incomplete validation of RSA public keys during SSH authentication. An attacker who knows a valid username and the public modulus of that user’s RSA key can construct a different key pair. Because the system does not fully validate the key, the attacker can authenticate without possessing the legitimate private key. This effectively neutralizes SSH key-based authentication as a security control.

CVE-2026-86060: SSH Privilege Escalation

This flaw involves improper handling of specially crafted usernames in the SSH session. An attacker can supply a manipulated username string to elevate the session to full administrative privileges. Therefore, even a low-privilege or partially authenticated session can be escalated to complete control.

Third Related Flaw: CVE-2026-67277

Poland’s CERT also highlighted CVE-2026-67277, which affects the RouterOS bandwidth-test service. This vulnerability allows unauthenticated attackers to leak kernel memory or remotely crash and restart the router. While not part of the MikroTrick authentication chain, it adds another attack surface for exposed devices.

Both MikroTrick vulnerabilities were fixed in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. The updates also include a compromise-detection mechanism that scans for known signs of unauthorized configuration changes at startup. If detected, the system disables malicious entries and logs a critical warning. However, the absence of a compromise marker should not be interpreted as proof that a device is clean.

Business and Operational Impact

MikroTik routers are widely deployed in internet service providers, small businesses, enterprises, and critical infrastructure. A successful MikroTrick compromise gives attackers full control over network traffic, enabling surveillance, credential theft, lateral movement, and botnet recruitment.

The operational impact includes:

• Network traffic interception: Attackers can inspect, redirect, or modify all traffic passing through the router.
• Credential harvesting: Captured authentication data can be used to breach downstream systems.
• Lateral movement: Compromised routers serve as footholds for deeper network infiltration.
• Botnet enrollment: Hijacked routers are commonly recruited into DDoS and proxy botnets.
• Service disruption: Attackers can reconfigure or brick devices, causing outages.

As of September 5, 2026, Shadowserver Foundation data shows approximately 122,500 MikroTik devices with an exposed SSH interface worldwide. The exact number vulnerable to MikroTrick has not been determined, but the exposure is significant. Internet-facing routers are high-value targets because they sit at the network perimeter and often lack endpoint detection.

Mitigation and Recommendations

Defenders should treat this as an active threat requiring immediate action. The following steps reduce risk and help contain existing compromise.

Immediate Actions for Defenders

1. Patch immediately: Upgrade to RouterOS 7.25beta3, 7.24.2, 7.23.4, or 6.49.21. Apply the update as soon as possible because unpatched devices remain at risk.
2. Restrict SSH access: Disable SSH or restrict it to trusted management networks. Avoid exposing SSH to the internet unless absolutely necessary.
3. Disable bandwidth-test service: If not required, disable the bandwidth-test service to mitigate CVE-2026-67277.
4. Inspect for compromise: Check logs for entries reading login failure for user -2 from <ip> via ssh or user <name> added by ssh:-2@<ip>. Also look for a highly privileged ops account that should not exist.
5. Monitor known IPs: Review traffic for connections from 82.192.72.4 and 103.102.31.18, which are linked to confirmed and attempted exploitation.
6. Factory reset if compromised: Isolate the router, preserve logs and configuration, then factory-reset and rebuild from a trusted configuration. Rotate all passwords, keys, and secrets afterward.

Long-Term Hardening Measures

• Use management VLANs or out-of-band interfaces for administrative access rather than internet-facing services.
• Implement firewall rules that block inbound SSH and Winbox from untrusted networks.
• Enable logging and centralize router logs to a SIEM for anomaly detection.
• Regularly audit router configurations against known-good baselines.
• Apply updates within 24 to 48 hours of release for critical infrastructure.

Bottom line: MikroTik routers are under active attack through the MikroTrick vulnerability chain. Over 122,000 devices have exposed SSH. Patch now, restrict access, and inspect for indicators of compromise. Delayed response increases the risk of full network compromise.

Incident Summary

CVE ID / Incident:	CVE-2026-67276 (SSH auth bypass), CVE-2026-86060 (SSH privilege escalation), CVE-2026-67277 (bandwidth-test memory leak / DoS)
Affected Systems:	MikroTik RouterOS devices with SSH or bandwidth-test exposed to the internet
Disclosure Date:	September 3, 2026
Patch Status:	Patches available in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21
Active Exploitation:	Confirmed by Poland’s CERT
Exposed Devices:	~122,500 (SSH exposed, per Shadowserver, September 5, 2026)
IoC IPs:	82.192.72.4 (confirmed attacks), 103.102.31.18 (attempted exploitation)

References

1. BleepingComputer, “Hackers exploit new MikroTik RouterOS flaws to hijack routers,” September 7, 2026, https://www.bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/
2. Poland CERT, “Vulnerabilities in MikroTik RouterOS actively exploited,” September 2026, https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
3. MikroTik Security Advisory, “September 2026 vulnerability,” September 3, 2026, https://mikrotik.com/supportsec/september-2026-vulnerability
4. NVD, CVE-2026-67276, https://nvd.nist.gov/vuln/detail/CVE-2026-67276
5. NVD, CVE-2026-86060, https://nvd.nist.gov/vuln/detail/CVE-2026-86060
6. NVD, CVE-2026-67277, https://nvd.nist.gov/vuln/detail/CVE-2026-67277