Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet.
One of the security issues, tracked as CVE-2026-67276, is an SSH authentication bypass flaw in MikroTik RouterOS caused by incomplete validation of RSA public keys.
An attacker who knows a username and the public modulus of that user’s key can exploit it by crafting a different key and logging in without the legitimate private key.
The second security issue is identified as CVE-2026-86060. It is an SSH privilege escalation flaw in MikroTik RouterOS due to improper handling of specially crafted usernames.
Hackers can leverage it using a specially crafted username to manipulate the SSH session so that the attacker obtains full administrative privileges.
Both vulnerabilities were discovered by Poland’s CERT agency with the help of GPT-5.5-cyber and GPT-5.6-sol and received a critical severity rating.
The Polish agency dubbed the exploit chain “MikroTrick,” and warned that it is now actively exploited in the wild.
“In recent days we have been observing attacks against RouterOS devices accessible from the internet,” Poland’s CERT warns.
“We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks.”
The Polish CERT also highlighted a third flaw, CVE-2026-67277, which affects the RouterOS bandwidth-test service and allows unauthenticated attackers to leak kernel memory or to remotely crash/restart the router.
MikroTik fixed the vulnerabilities in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, released on September 3, and Poland’s CERT validated the fixes.
In its advisory, the vendor notes that not all configurations are affected, but did not disclose any details to give users time to apply the security updates.
The updates add a compromise-detection mechanism to the routers that looks for known signs of unauthorized configuration changes at startup, disables malicious entries, and logs a critical warning.
However, the CERT notes that the absence of a marker indicating compromise should not be taken as a guarantee that a router has not been compromised.
The CERT shared the following indicators of compromise (IoCs):
- Log entries: ‘login failure for user -2 from
via ssh’ and ‘user added by ssh:-2@ ’ - Presence of a highly privileged ops account
- 82.192.72.4 — linked to confirmed successful attacks
- 103.102.31.18 — observed attempting to exploit MikroTrick
If compromise is suspected, the Polish agency recommends isolating the router, preserving logs and configuration, then factory-resetting the device and rebuilding it from a trusted configuration while rotating passwords, keys, and other secrets.
For those unable to apply the updates immediately, one recommendation is to restrict or disable externally accessible SSH, WWW/WWW-SSL, and bandwidth-test services, and avoid the built-in SSH clients and outbound TLS connections over untrusted networks.
As of September 5, there were 122,500 MikroTik devices with an exposed SSH interface, according to data provided by The ShadowServer Foundation. The exact number of devices vulnerable the MikroTik exploit was not determined, though.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
