MikroTik RouterOS Flaws Chained to Hijack Internet-Exposed Routers
Summary
Poland’s CERT says the MikroTrick chain exploits two RouterOS flaws to take over routers with exposed SSH. MikroTik released fixes and startup compromise detection; CERT advises updates and securing exposed services.
Key points
- CVE-2026-67276 allows SSH authentication bypass through incomplete validation of RSA public keys.
- CVE-2026-86060 enables privilege escalation through specially crafted usernames, potentially granting full administrative access.
- Poland’s CERT named the exploit chain “MikroTrick” and reports it is actively exploited against internet-accessible RouterOS devices.
- A separate flaw, CVE-2026-67277, affects the bandwidth-test service and can expose kernel memory or crash/restart a router.
- MikroTik released fixes in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21; the updates also add startup checks for signs of unauthorized configuration changes.
- CERT says a missing compromise marker does not guarantee a router is clean. Suspected devices should be isolated, logs and configuration preserved, then factory-reset and rebuilt with secrets rotated.
- CERT recommends applying updates or, if that is not immediately possible, restricting or disabling externally accessible SSH, WWW/WWW-SSL, and bandwidth-test services.
Article Details
- Vulnerability Types
- SSH authentication bypass through incomplete RSA public key validation
- SSH privilege escalation through improper handling of specially crafted usernames
- Unauthenticated kernel memory disclosure or remote router crash/restart through the bandwidth-test service
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict or disable externally accessible SSH, WWW/WWW-SSL, and bandwidth-test services.
- Avoid the built-in SSH clients and outbound TLS connections over untrusted networks.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]102[.]31[.]18 | IP address observed attempting to exploit the MikroTrick chain, according to Poland’s CERT. |
| IPV4 | 82[.]192[.]72[.]4 | IP address linked to confirmed successful attacks, according to Poland’s CERT. |
CVE
CVE-2026-67276Mikrotik · RouterosHackers are chaining CVE-2026-67276 and CVE-2026-86060 in MikroTik RouterOS to bypass SSH authentication and gain full administrative control of internet-exposed routers.CVE-2026-67277Mikrotik · RouterosThe Polish CERT also highlighted a third flaw, CVE-2026-67277, which affects the RouterOS bandwidth-test service and allows unauthenticated attackers to leak kernel memory or to remotely crash/restart the router.CVE-2026-86060Mikrotik · RouterosHackers are chaining CVE-2026-67276 and CVE-2026-86060 in MikroTik RouterOS to bypass SSH authentication and gain full administrative control of internet-exposed routers.
Vendors
Products
Tools
GPT-5.5-cyberBoth vulnerabilities were discovered by Poland’s CERT agency with the help of GPT-5.5-cyber and GPT-5.6-sol and received a critical severity rating.GPT-5.6-solBoth vulnerabilities were discovered by Poland’s CERT agency with the help of GPT-5.5-cyber and GPT-5.6-sol and received a critical severity rating.