MikroTik Patches RouterOS Flaws Reportedly Chained to Take Over Routers

Summary

CERT Poland says attackers are chaining two MikroTrick flaws to take control of MikroTik routers with publicly accessible SSH. MikroTik has released patches and urges users to update.

Key points

CERT Poland reports that two RouterOS vulnerabilities, dubbed MikroTrick, are being chained to bypass authentication and take full control of devices with SSH exposed to public networks.
The reported attacks have been underway since at least September 2 and create an account named “ops,” according to CERT Poland.
CERT Poland identified CVE-2026-67276, an SSH authentication bypass, and CVE-2026-86060, an SSH session privilege manipulation flaw, as the chained vulnerabilities.
The six fixes also address memory disclosure and denial of service, TLS server impersonation, file tampering, and disclosure of root-owned files.
MikroTik recommends updating to RouterOS 7.25beta3, 7.24.2, 7.23.4, or 6.49.21; CERT Poland says updating prevents the reported attacks.
MikroTik advises blocking SSH access from untrusted sources. CERT Poland warns that missing listed artifacts do not rule out unauthorized activity.
Shadowserver found more than 120,000 MikroTik devices with internet-accessible SSH in a 24-hour scan on September 5.

Article Details

Vulnerability Types: SSH authentication bypass
SSH session privilege manipulation
Memory disclosure
Denial of service
TLS server impersonation
Unauthenticated file tampering
Disclosure of root-owned files
Severity: CVSS 9.2 for CVE-2026-67276 and CVE-2026-86060; CVSS 8.8 for CVE-2026-67277.
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Block SSH access from untrusted sources.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]102[.]31[.]18`	Source-reported origin of attacks exploiting the MikroTrick vulnerabilities.
IPV4	`82[.]192[.]72[.]4`	Source-reported origin of attacks exploiting the MikroTrick vulnerabilities.