CERT Polska published a warning about active exploitation of vulnerabilities in MikroTik RouterOS that allow attackers to gain full administrative control of the router without authentication via an SSH service exposed to the internet. Successful attacks have been observed at least since 2 September 2026. Fixed RouterOS versions are already available: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable). All administrators of MikroTik devices with exposed management ports must immediately install the update and review the configuration for signs of compromise.
Technical details of the vulnerabilities
CERT Polska has named the discovered attack chain MikroTrick. According to available data, a combination of two vulnerabilities is used to obtain administrative access; however, neither CERT nor MikroTik had disclosed at the time of publication exactly which two vulnerabilities form the observed exploitation chain.
As part of the September security update, at least five vulnerabilities were disclosed with entries in the GitHub Advisory Database:
- CVE-2026-86060 — argument injection via SSH that allows changing the RouterOS policy mask and performing privilege escalation. CVSS v4: 9.2 (critical).
- CVE-2026-67281 — unauthenticated file read and path traversal via WebFig /jsproxy. CVSS v4: 8.7.
- CVE-2026-67277 — vulnerability in the bandwidth-test service: disclosure of uninitialized data and integer overflow of packet size prior to authentication. CVSS v4: 8.8.
- CVE-2026-67279 — SSH state machine bug that allows command execution without authentication in the RouterOS file space. CVSS v4: 6.9.
- CVE-2026-67278 — X.509/RSA signature validation bug that under certain conditions allows forging a trusted certificate. CVSS v4: 6.3.
It should be noted that all of the above entries in the GitHub Advisory Database have the status “unreviewed”, and in several entries the affected versions are listed as unknown. Nevertheless, given the confirmed active exploitation and the highest CVSS v4 score of 9.2 for CVE-2026-86060, the overall severity of the situation is assessed as high.
The question of zero-day status
The timeline of events does not allow for a definitive conclusion on whether the exploitation was a zero-day attack. Successful attacks have been recorded since 2 September, while the changelog for beta version 7.25beta3 is dated the same day, and the first fixes were announced on 2–3 September. These dates do not prove that a working patch was available before the attacks began, therefore the zero-day status remains unconfirmed.
Who is at risk
The greatest risk is to MikroTik devices whose management services (SSH, WWW/WWW-SSL, bandwidth-test) are exposed to the internet. According to MikroTik’s documentation, home devices with default, unchanged firewall rules block public access to management ports. However, the risk increases significantly when filtering rules are modified, port forwarding is configured, or other user configurations are applied that expose management interfaces.
MikroTik routers are widely used by ISPs, small and medium businesses, and in corporate networks. Compromise of a router gives an attacker the ability to intercept traffic, redirect DNS queries, create persistence points for further lateral movement, and use the device as part of botnets. At the time of publication, neither the number of victims nor attribution of the attackers had been established.
Indicators of compromise and diagnostics
CERT Polska highlights the following signs that require investigation:
- Flagged status — RouterOS automatically flags the device when it detects suspicious configuration during boot. Check it with the command
/system/device-mode/print. Details are available in the device mode documentation. - Unknown privileged accounts — pay special attention to accounts in the ops group or similar highly privileged groups.
- Log entries for account creation that contain the string
ssh:-2@. - Unrecognized scripts, scheduler jobs and other configuration changes.
Important: the absence of Flagged status does not guarantee that the device has not been compromised.
Response recommendations
Immediate update
Install the fixed RouterOS versions from the official download page:
- 6.49.21 — Long-term branch for RouterOS 6.x
- 7.23.4 (or 7.23.5, which fixes an IPv6 DHCP regression) — Long-term branch for RouterOS 7.x
- 7.24.2 — Stable branch
Temporary measures before updating
- Disable or restrict access to SSH, WWW/WWW-SSL and bandwidth-test services, allowing connections only from trusted management networks.
- Do not initiate TLS connections and do not use the built-in RouterOS SSH client from an unpatched device — this covers a broader set of vulnerabilities, including CVE-2026-67278.
Actions if compromise is suspected
- Isolate the router from the network. Save logs and configuration before making any changes. CERT Polska provides a data preservation guide (in Polish).
- Do not clear the Flagged status until analysis and evidence collection are complete.
- Perform a reset to factory settings and restore the configuration manually from a trusted source. Do not restore a full backup from a potentially compromised device.
- Rotate all secrets: passwords, SSH keys, certificates and any other credentials used on the device.
Post-update verification
Even if there are no obvious signs of compromise, after installing the update perform:
- Review of system logs for suspicious events
- The command
/system/device-mode/printto check the status - An audit of the list of users, scripts and scheduler jobs
The MikroTrick chain illustrates that even a single exposed management service on a router can lead to complete loss of control over the device. The priority action is to update RouterOS to the fixed versions (6.49.21, 7.23.4/7.23.5 or 7.24.2), followed by a configuration review for all listed indicators. If management ports were exposed to the internet between 2 September and now, the device should be treated as potentially compromised and a full incident response cycle should be carried out.
