CRITICAL: MikroTik RouterOS Flaws Chained to Hijack Routers Over SSH

MikroTik routers have a habit of showing up in places nobody remembers installing them. They sit in branch offices, on wireless ISP towers, in dental clinics, and in the back closet of that client who swore up and down they only had a consumer router. That ubiquity is exactly why this week's news matters. Poland's national CERT has documented an exploit chain it calls MikroTrick, which strings together two critical RouterOS flaws so a remote attacker can walk in over SSH and leave with full administrative control, no password required. Attackers were using it before MikroTik shipped a fix, CISA has added the flaws to its Known Exploited Vulnerabilities catalog, and the Shadowserver Foundation counted roughly 122,500 RouterOS devices with SSH reachable from the public internet in a single day of scanning.

This is the kind of bug that earns the drop everything and patch it now treatment. A compromised edge router is not just one compromised box. It is the front door, the traffic cop, and the security camera for every network sitting behind it. An attacker who owns it can rewrite firewall rules, intercept or redirect traffic, add persistent backdoor accounts, pivot into the internal network, or quietly enlist the device in a botnet. None of that trips an endpoint agent, because nobody runs an endpoint agent on their router.

The chain starts with CVE-2026-67276, a CVSS 9.2 authentication bypass in the RouterOS SSH server. According to CERT Polska, RouterOS does not compare the complete RSA public key when it validates public key authentication, and it leaves the exponent out of the comparison entirely. That sounds like a pedantic implementation detail until you think about what it enables. An attacker who knows a valid username and the modulus of that user's public key can craft an alternative key that RouterOS happily accepts, without ever touching the legitimate private key. Public keys are, by definition, not secret, so the bar here is a lot lower than anyone would like. This flaw affects RouterOS 7.9 through 7.23.3 along with 7.24 and 7.24.1.

Getting in as a restricted user would be bad enough, but the second half of the chain removes the restrictions. CVE-2026-86060, also rated 9.2, is an argument injection flaw in the SSH login path. When a username begins with a prohibited character, RouterOS mishandles the argument delimiters and allows the trusted policy mask for the session to be changed. In plain English, a carefully crafted username convinces the router to apply full administrator policy to what should have been a limited session. CISA's catalog entry calls it improper neutralization of argument delimiters in a command, which is the formal way of saying the router believed whatever the attacker typed into the username field. This one reaches back much further, covering RouterOS 6.0.0 through 6.49.20, 7.0.0 through 7.23.3, and 7.24 through 7.24.1 as well.

Put the two together and CERT Polska confirms you get complete device compromise from an unauthenticated position, as long as the attacker can reach SSH. That single precondition is the whole ballgame, and we will come back to it.

CERT Polska also flagged CVE-2026-67277, a CVSS 8.8 missing authentication bug in the bandwidth test service, better known to MikroTik admins as btest. RouterOS accepts a related btest connection before the primary session has finished authenticating, which lets an unauthenticated client start an IPv4 UDP test and abuse that state to read kernel memory or crash the device. It is not required for the takeover chain, but CISA added it to KEV right alongside CVE-2026-86060, and leaking kernel memory from the box that routes all your traffic is never a good look. The full CERT Polska disclosure actually covers six CVEs, including a second RSA signature verification weakness, an SSH rekey workflow flaw, and an uninitialized pointer bug in the WebFig interface, and all of them are resolved by the same set of updates.

There is a distinctly modern twist in how these bugs came to light. CERT Polska researcher Sławomir Rozbicki identified the flaws with help from OpenAI models provided through a government collaboration program, which makes MikroTrick one of the more prominent examples of AI assisted vulnerability research landing a real, exploited, critical bug in widely deployed network gear. Defenders using AI to find bugs faster is genuinely good news. The uncomfortable flip side is that attackers have access to the same class of tools, and the window between a bug existing and a bug being exploited keeps getting smaller.

Now for the part that should get your attention. Exploitation began no later than September 2, 2026, a full day before MikroTik shipped patched builds on September 3. Researchers tied early activity to the IP address 82.192.72.4, and 103.102.31.18 has also been associated with the campaign. MikroTik initially held back technical details to give customers time to update and stressed that most configurations are not at risk. That statement is true in the narrow sense that the chain needs SSH reachable by the attacker. It is considerably less comforting when six figures worth of devices expose exactly that. Shadowserver's count of roughly 122,500 internet facing SSH interfaces on September 5 does not tell us how many of those are running vulnerable builds, but anyone who has ever audited a MikroTik fleet knows how rarely those boxes see a firmware update after the day they were racked. CISA's federal remediation deadline for the KEV entries was September 13, which tells you how seriously the agency is taking this one.

The good news, relatively speaking, is that the attack leaves fingerprints. Search your RouterOS logs for entries reading login failure for user -2 and user added by ssh:-2@, since that odd negative username has shown up repeatedly in compromised devices. Check the user list for an unexpected privileged account named ops, which attackers have been leaving behind. Connections from the two IP addresses above are worth hunting for in whatever firewall logs or NetFlow data you retain. MikroTik also says RouterOS will mark a compromised device with a Flagged status, so the upgrade doubles as a quick health check.

So what should you actually do? Upgrade, and do it today. The fixed builds are RouterOS 6.49.21 on the long term 6.x branch, 7.23.4 on the long term 7.x branch, and 7.24.2 on the stable channel, with 7.25beta3 carrying the same fixes for anyone brave enough to run the testing train in production.

If a maintenance window is not in the cards today, take SSH off the internet right now. MikroTik's own guidance is to make sure SSH is never open to untrusted networks and to reach management interfaces through a VPN instead. CERT Polska goes further and recommends disabling or restricting SSH, the www and www-ssl web services, and the bandwidth test server until patches are in place. On RouterOS that means setting a tight allowed address list on each entry under IP Services, dropping inbound management traffic on the WAN interface with a firewall filter rule, and turning off the btest server unless you genuinely rely on it. Honestly, if your btest server is listening on the open internet in 2026, this advisory is doing you a favor.

Patching does not evict someone who already got in. If you find the log entries or the rogue account, treat the router as compromised rather than merely vulnerable. CERT Polska advises isolating the device, preserving logs and configuration exports as evidence, performing a factory reset, and rotating credentials. In practice that should include every secret the router ever touched, from VPN keys and RADIUS shared secrets to wireless passphrases and any admin passwords reused elsewhere. MikroTik separately recommends reviewing the configuration after upgrading for unknown scripts, users, or other settings you do not recognize. Pay special attention to the scheduler, because an attacker who owns an edge router loves nothing more than a quiet job that reinstalls their access at 3 a.m.

The bigger lesson is one this industry keeps relearning the hard way. Edge devices are the soft underbelly of most small and midsize networks because they get configured once, forgotten, rarely monitored, and almost never watched by any security tooling. Attackers understand that perfectly. Whether the logo says Fortinet, Ivanti, Cisco, or now MikroTik, the playbook never changes. Find a bug that works before authentication in something facing the internet, move before defenders can patch, and enjoy a foothold nobody is looking at. Management planes belong behind a VPN or a strict allowlist, full stop, and any router exposing SSH to the entire planet is a liability that is simply waiting for its CVE number.

For MSPs, MikroTrick is a ready made reason to run an external attack surface scan across every client and flag each RouterOS device with SSH or WebFig open to the world. Turn those findings into a managed edge hardening and firmware lifecycle service, because clients who have not thought about their router since the day it was installed will suddenly understand why that line item exists.