CERT Polska has published details of six vulnerabilities in MikroTik RouterOS, with the combination of the two most dangerous flaws receiving its own name — MikroTrick. The chain allows attackers to gain full control of a device without authentication if its SSH service is exposed to the internet. According to The Hacker News, successful attacks have been observed since at least September 2, 2026, while the number of victims and the identity of the attackers have not been disclosed. MikroTik confirmed active exploitation and released fixes in versions 7.25beta3, 7.24.2, 7.23.4 and 6.49.21.
The vulnerabilities affect the SSH server and client, the bandwidth-test service, X.509 certificate handling and the WebFig web interface. The vendor emphasizes that every minute of delay in installing the update increases the risk of compromise. CERT Polska coordinated disclosure of the vulnerabilities with the manufacturer, and the released patches, according to the center, prevent the observed attacks. For home users with default configurations, the risk is lower because management ports are usually closed, but for devices with SSH exposed to the internet, the threat is critical.
Key fact: MikroTrick allows attackers to take over a MikroTik router without a password or keys — it is enough for SSH to be reachable from the public network. Neither password protection nor key-based authentication prevents the attack.
The attack is based on argument injection in the SSH login handling mechanism. RouterOS passed the username directly as an argument to another system process — /bin/login — without proper sanitization. Researchers reproduced the attack locally: the attacker submits the username "-2", which simultaneously acts as a command-line argument for /bin/login, then triggers a forced rekey of the SSH connection, after which the protocol proceeds directly to channel opening and command execution without any authentication. It does not matter whether the administrator uses passwords or cryptographic keys — if SSH is reachable, the device remains vulnerable until the update is installed.
In real-world attacks, compromised routers were used to create a backdoor: attackers used injected commands to add a user named ops with a password and membership in the full group, granting maximum privileges. The presence of an ops user is an indicator of this specific campaign, but it is not required for the exploit to work: attackers can make any configuration changes they want. Patched versions specifically check for the presence of the ops user, confirming that MikroTik is aware of active exploitation and has adapted the Flagged mechanism accordingly. On compromised devices, traces remain in autosupout.rif diagnostic files: sshd process crashes with signal 12 immediately after command execution indicate exploitation attempts. Importantly, the vulnerability is not limited to SSH: it resides in a core library used by all management services, so Winbox, WebFig and the API should also be considered potentially vulnerable.
The most dangerous flaw is CVE-2026-67276 (CVSS 9.2), an SSH authentication bypass. RouterOS incorrectly validated public keys used for SSH authentication: the system did not compare the entire RSA key assigned to the user. An attacker who knew the username and the public modulus of the key could forge another key and log in over SSH without the corresponding private key, gaining the privileges of the targeted account.
The second link in the chain is CVE-2026-86060 (CVSS 9.2), which allows manipulation of SSH session privileges through a specially crafted username. RouterOS incorrectly handled usernames beginning with a prohibited character in the SSH login mechanism. By using a crafted username, an attacker could escalate privileges, causing the resulting session to receive full administrative rights in RouterOS. The combination of these two vulnerabilities forms the MikroTrick chain.
The third vulnerability, CVE-2026-67277 (CVSS 8.8), is related to the bandwidth-test service: an unauthenticated connection could enter a state that should only be reachable after login. Combined with a leak of uninitialized data from a packet buffer and an integer underflow during size validation, this could lead to kernel memory disclosure or a remote DoS causing the system to reboot. CVE-2026-67279 was also described: RouterOS SSH proceeds to the connection protocol after a client-requested rekey even if user authentication was never attempted — this flaw is what enables the jump to command execution.
The primary recommendation is to immediately upgrade RouterOS to one of the fixed versions: 7.25beta3, 7.24.2, 7.23.4 or 6.49.21. After updating, the device should be checked for signs of compromise: review logs for compromise-related messages and inspect the Flagged marker in the output of the /system/device-mode/print command, check the configuration for unknown users (especially ops), scripts, scheduler tasks and other unrecognized changes. The absence of the marker does not rule out an earlier compromise, so a full configuration audit is required. If a breach is detected, experts recommend changing all passwords, removing unknown SSH keys and restoring the configuration from a verified clean backup.
If installing the patch immediately is not possible, MikroTik and CERT Polska recommend blocking all management services from untrusted networks: disable SSH, WWW/WWW-SSL and the bandwidth-test server, or restrict access to trusted addresses only. Do not expose Winbox or WebFig to the internet, segment management traffic into a separate VLAN in large internal networks, and connect to the device through a trusted VPN such as WireGuard. In addition, do not initiate TLS connections from an unpatched device and do not use the built-in SSH clients /system ssh and /system ssh-exec, especially when traffic passes through untrusted networks.
Rule from MikroTik: “Do not expose Winbox, Webfig or SSH to the internet, use a firewall and connect through a trusted VPN such as WireGuard. Do this if you cannot update,” the vendor urges. The absence of the Flagged marker does not guarantee that the device was not compromised earlier.
MikroTik equipment is extremely popular among home users, small offices and internet service providers, making RouterOS one of the most common targets in the world of network devices. Hundreds of thousands of routers with internet-exposed management ports are regularly discovered by scanners, and every critical RouterOS vulnerability is quickly adopted by botnets. Previous campaigns have already shown MikroTik routers being hijacked for proxy traffic, cryptocurrency mining and DDoS attacks. Regulators are also paying attention to the problem: CISA has repeatedly added RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalog, requiring federal agencies to install patches within strict deadlines.
The current situation is aggravated by the fact that the vulnerable code had existed for many years: according to the vendor, “versions spanning many years are affected,” while fixes are available only starting with the listed releases. This means that a significant number of older devices may never receive a patch and could remain vulnerable permanently. The MikroTrick case once again demonstrates that the security of network infrastructure depends not only on the vendor's response speed, but also on administrator hygiene — closed management ports, segmentation and VPN access can neutralize even attacks that require no authentication.
“Security is not a product, but a process. A router with SSH exposed to the internet and default settings is not a network device, but an invitation to an attacker.”
— Bruce Schneier, cryptographer and security specialist
