MikroTik has released emergency patches for six RouterOS vulnerabilities. The 'MikroTrick' exploit chain allows attackers to bypass authentication and seize complete control of networking devices.
- MikroTik patched 6 critical vulnerabilities in RouterOS to prevent device takeover.
- The 'MikroTrick' exploit chain combines SSH bypass and privilege manipulation.
- CERT Poland confirmed active exploitation of these flaws since early September.
- Over 120,000 devices were found with exposed SSH ports globally.
Networking hardware giant MikroTik has urgently rolled out security updates for its RouterOS, warning users of six vulnerabilities that could lead to total device compromise. Two of these flaws are being actively exploited in the wild under the moniker 'MikroTrick', enabling remote attackers to bypass authentication and overwrite critical configuration files.
According to CERT Poland, the attack vector involves chaining two specific vulnerabilities: CVE-2026-67276 (SSH authentication bypass) and CVE-2026-86060 (SSH session privilege manipulation). Both carry a devastating CVSS score of 9.2. By combining these, hackers can gain root-level access to any device where the SSH service is exposed to the public internet.
Why This Matters
BozokMedia analysis shows that the scale of this threat is amplified by poor configuration hygiene. With the Shadowserver Foundation identifying over 120,000 exposed devices in a single day, the attack surface is massive. When a perimeter router is compromised, it becomes a beachhead for lateral movement into the entire corporate or home network.
The chaining of authentication bypass with privilege escalation is the 'perfect storm' for network hardware, turning a gateway into an open door.
Forensic evidence indicates that attackers have been active since September 2, often creating a backdoor account named 'ops' to maintain persistence. CERT Poland warns that the presence of this account or 'Flagged' entries in the system logs are definitive indicators of a compromise attempt.
| CVE ID | Vulnerability Type | Severity (CVSS) |
|---|---|---|
| CVE-2026-67276 | SSH Authentication Bypass | 9.2 (Critical) |
| CVE-2026-86060 | SSH Privilege Manipulation | 9.2 (Critical) |
| CVE-2026-67277 | Memory Disclosure/DoS | 8.8 (High) |
Beyond the MikroTrick chain, the updates also address CVE-2026-67278, which allows TLS server impersonation, and CVE-2026-67281, which permits the disclosure of root-owned configuration stores. Users are strongly urged to update to RouterOS versions 7.25beta3, 7.24.2, 7.23.4, or 6.49.21 immediately.
Frequently Asked Questions
Q1: How can I tell if my MikroTik router has been breached?
A: Check your logs for 'Flagged' entries and inspect your user list for any unauthorized accounts, specifically one named 'ops'.
Q2: What is the immediate mitigation step if I cannot update right now?
A: Immediately block SSH access from all untrusted or public IP addresses via the firewall settings.
