MikroTik Routers Under Attack via SSH Flaws
MikroTik Routers Hijacked via 'MikroTrick' Unauthenticated Exploit
Impact Scope
People Affected
Over 122,500 devices potentially exposed
Industries Affected
Related Entities
Organizations
Products & Tech
CVE Identifiers
Full Report
Executive Summary
MikroTik routers are under active attack from an exploit chain dubbed "MikroTrick," which allows unauthenticated attackers to gain full administrative control of devices with an internet-exposed SSH port. According to a warning from CERT Polska, attackers are combining two vulnerabilities—an SSH authentication bypass (CVE-2026-67276) and a privilege escalation flaw (CVE-2026-86060)—to hijack devices. Exploitation has been observed in the wild since at least September 2, 2026, meaning the flaws were exploited as zero-days before patches were available. With over 122,000 MikroTik devices estimated to have SSH exposed online, the potential attack surface is massive. MikroTik released patched versions of RouterOS on September 3, 2026, and administrators are strongly advised to update immediately, disable public SSH access, and audit devices for compromise.
Vulnerability Details
The "MikroTrick" attack chains two separate vulnerabilities in MikroTik's RouterOS:
CVE-2026-67276 (CVSS 9.2) - Authentication Bypass: This flaw exists in how RouterOS's SSH server verifies RSA public keys. The system improperly checks only the public modulus of the key, not the entire key. This allows an attacker who knows a valid username and the public modulus of that user's associated key to forge a different key with the same modulus and successfully authenticate without possessing the corresponding private key.
CVE-2026-86060 (CVSS 9.2) - Privilege Escalation: This vulnerability is in the handling of SSH usernames. An attacker can craft a specific username (reportedly
"-2") that, when used during an SSH session, results in the session being granted full administrative privileges, regardless of the actual user's permissions.
By combining these two flaws, an attacker can log in without a valid private key and immediately gain complete control of the router.
Affected Systems
- Product: MikroTik RouterOS
- Affected Versions: All versions before the patched releases.
- Patched Versions:
6.49.21(long-term)7.23.4(stable)7.24.2(testing)
Any device running an older version with SSH exposed to the internet is considered highly vulnerable.
Exploitation Status
Active Exploitation: CERT Polska has confirmed active exploitation since at least September 2, 2026, predating the patch release on September 3. Attackers are scanning the internet for vulnerable routers and compromising them. The Shadowserver Foundation identified over 122,500 internet-accessible MikroTik devices with SSH open on September 5, 2026.
Impact Assessment
A full administrative compromise of a router has severe consequences. An attacker can:
- Monitor, redirect, or block all traffic passing through the router.
- Use the router as a pivot point to attack other devices on the internal network.
- Install persistent malware or backdoors on the device.
- Incorporate the router into a botnet for DDoS attacks or other malicious activities.
- Steal credentials and sensitive data from network traffic.
For businesses and home users alike, this represents a complete loss of network security and privacy.
IOCs — Directly from Articles
82.192.72.4103.102.31.18ops-2Detection & Response
Administrators should immediately perform the following checks on their MikroTik devices:
- Check for Unauthorized Users: Log into the router and inspect the user list for any unfamiliar accounts, especially a user named
ops. Remove any unauthorized users immediately. - Review Logs: Examine router logs for login failures or successful logins from a user named
-2. Also, look for SSH connections from the attacker IPs listed above. - Inspect Scripts and Schedulers: Attackers often create scheduled tasks or scripts to maintain persistence. Carefully review all scripts and scheduler entries for malicious activity.
- Export and Audit Configuration: Export the router's configuration and manually review it for any unauthorized changes, such as firewall rules, NAT entries, or VPN configurations.
If any signs of compromise are found, a full device reset and reconfiguration from scratch is the safest course of action, after patching.
Mitigation
- Update RouterOS: The most critical step is to upgrade RouterOS to one of the patched versions (
6.49.21,7.23.4, or7.24.2) immediately. - Disable Public SSH Access: Do not expose the SSH management port (TCP 22) to the internet. If remote management is necessary, restrict access via firewall rules to specific, trusted IP addresses or require a secure VPN connection first.
- Use Strong, Unique Passwords: While not directly related to this key-based exploit, strong passwords are a fundamental security practice.
- Disable Unused Services: Disable any management services on the router that are not actively used to reduce the overall attack surface.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Updating RouterOS to a patched version is the primary remediation for these vulnerabilities.
Preventing public internet access to the SSH management port is a critical mitigating control.
Auditing device configurations and logs for indicators of compromise is essential for detection and response.
Disabling the SSH service if it is not needed reduces the device's attack surface.
D3FEND Defensive Countermeasures
The most critical action for all MikroTik administrators is to immediately upgrade their RouterOS devices to a patched version. This is an emergency patch scenario due to active, unauthenticated exploitation. The patched versions are 6.49.21 (long-term), 7.23.4 (stable), or 7.24.2 (testing). This software update directly remediates both the authentication bypass (CVE-2026-67276) and the privilege escalation (CVE-2026-86060) vulnerabilities. Use the built-in 'Check For Updates' feature in WinBox or the web interface to apply the patch. Given the severity and ease of exploitation, this action should be prioritized above all others.
As a powerful compensating control, administrators must block all inbound traffic from the internet to the router's SSH port (TCP/22). This can be done by creating a firewall rule in RouterOS that drops input traffic on the public-facing (WAN) interface destined for TCP port 22. If remote SSH access is absolutely necessary, this rule should be modified to only allow traffic from a specific, trusted source IP address or range. This single configuration change prevents attackers from ever reaching the vulnerable SSH service, effectively mitigating the threat even on an unpatched device. This is a fundamental security best practice for any network device.
Following patching and hardening, a thorough audit for compromise is necessary. The primary indicator is the presence of an unauthorized user account named 'ops'. Connect to your MikroTik router and navigate to the user management section. Scrutinize the list of all configured users. If an account named 'ops' or any other unfamiliar administrative account exists, it is a definitive sign of compromise. In such a case, the device should be considered fully compromised. The malicious account should be removed, but a full device wipe and manual reconfiguration from a clean backup is the only way to ensure all attacker persistence mechanisms have been removed.
Timeline of Events
CERT Polska observes active exploitation of the MikroTik vulnerabilities in the wild.
MikroTik releases patched versions of RouterOS to address the vulnerabilities.
The Shadowserver Foundation reports over 122,500 MikroTik devices have SSH exposed to the internet.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.