MikroTik RouterOS Zero-Day Exploited via SSH
Attackers gain full control of routers since September 2
1Active Exploitation Since September 2
A critical zero-day vulnerability in MikroTik RouterOS has been actively exploited since September 2, 2026. The attack chain, dubbed 'MikroTrick', combines two vulnerabilities to bypass SSH authentication and escalate privileges. CERT Polska confirmed successful attacks creating 'ops' accounts dating back to at least September 2. Most attacks originated from a Leaseweb IP address (82.192.72[.]4). MikroTik released patches on September 3, but exploitation began before the fix.
2Critical Vulnerabilities in RouterOS
CERT Polska identified six vulnerabilities in MikroTik RouterOS, with two (CVE-2026-67276 and CVE-2026-86060) forming the MikroTrick chain. CVE-2026-67276 (CVSS 9.2) allows SSH authentication bypass using fake RSA keys, while CVE-2026-86060 enables privilege escalation. Together, they grant full administrator access to internet-exposed RouterOS devices with SSH enabled. Cybersecurity expert Costin Raiu published a technical breakdown on September 5, the same day CERT issued its advisory.
3Patch Immediately
MikroTik released fixes in RouterOS versions 7.24.2, 7.23.5, and 6.49.21. The 7.23.5 update addresses an IPv6 DHCP regression introduced in 7.23.4 while retaining security fixes. CERT Polska recommends immediate installation of these updates, followed by checks for unauthorized configuration changes. Users should verify their device status using /system/device-mode/print and inspect logs for suspicious activity.
4Default Firewall Protection
MikroTik's default firewall rules block public access to management ports on home devices. However, if these rules are modified or disabled, routers become vulnerable. CERT advises restricting SSH, WWW/WWW-SSL, and bandwidth-test services to trusted networks until updates are installed. They also warn against using RouterOS's built-in SSH clients or initiating TLS connections from unpatched devices.
5Signs of Compromise
Indicators of compromise include unexpected 'ops' accounts, account-creation logs containing 'ssh:-2@', and flagged device status. RouterOS flags devices when startup checks detect suspicious configurations, disabling certain functions. CERT recommends preserving evidence before clearing flagged status and investigating unrecognized users, scripts, or configuration changes.
6Recovery Steps
For compromised devices, CERT provides recovery steps: update RouterOS, inspect logs, check for unknown users/scripts, and verify device status. They emphasize not clearing flagged status before completing analysis. MikroTik's guidance notes that flagged devices have restricted functionality until the suspicious configuration is addressed.
7Exploitation Timeline
Exploitation began on September 2, before MikroTik's September 3 patch release, making it a zero-day. Polish security forums show September 2 exploitation attempts. Raiu suggests attackers may have known about impending patches and launched preemptive attacks. The scale of compromised devices remains unknown, but all internet-exposed MikroTik routers with SSH enabled are at risk.
8Immediate Action Required
All MikroTik router owners must treat internet-exposed SSH services as potentially compromised. Immediate actions include updating to patched versions, restricting management access, and auditing configurations. CERT's advisory underscores the severity of this threat, as attackers gain full administrative control without authentication. The MikroTrick chain highlights the risks of unpatched network devices.
Original article: Security Affairs — MikroTik RouterOS Zero-Day Exploited via SSH