Critical Vulnerabilities in MikroTik RouterOS Being Actively Exploited

Critical Vulnerabilities in MikroTik RouterOS Being Actively Exploited

The CERT Polska team has identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS. Combining two of them allows an attacker to take full control of the device without authentication if the device supports remote access using the SSH protocol. To make this chain easier to identify, we have given it a common name, MikroTrick. 🚨

In recent days, we have been observing attacks against RouterOS devices accessible from the internet. We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks. It has also been confirmed that the released patches prevent the observed attacks. We recommend applying the update immediately! 🔒

Affected Components

The vulnerabilities described affect the SSH server and client, the bandwidth-test service, X.509 certificate handling, and the WebFig interface. MikroTik has released fixes in versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, as announced in its security bulletin. Specifically:

• CVE-2026-67276: An SSH authentication bypass (CVSS: 9.2) allowed an attacker to log in via SSH without possessing the corresponding private key.
• CVE-2026-86060: An SSH session privilege manipulation via a crafted username (CVSS: 9.2) resulted in full administrative privileges.
• CVE-2026-67277: A memory disclosure and crash via bandwidth-test (CVSS: 8.8) enabled kernel memory leakage or a remote DoS attack.

Active Exploitation

Technical indicators and information obtained by CERT Polska through internal channels pointed to the possibility of RouterOS vulnerabilities being actively exploited in real-world attacks conducted in recent days. We now have confirmation that the combination of two of them (MikroTrick) is being exploited to take full control of devices whose SSH service is accessible from public networks. The observed attacks left the following markers in the RouterOS log: “login failure for user -2 from via ssh" and "user added by ssh:-2@". An additional indicator of compromise is the presence of a highly privileged user named **ops**.

Regarding the active exploitation of the vulnerability, CERT Polska’s analysis determined that the successful attacks observed so far, including the creation of the ops account, originated from the IP address 82.192.72.4 and have been occurring since at least September 2. In addition, the IP address 103.102.31.18 was used in attempts to exploit the described chain. The presence of any of these artifacts indicates an attempt to exploit the vulnerabilities and must be investigated immediately! ⚠️

Recommendations

We recommend updating RouterOS immediately to one of the versions containing the fixes: 7.25beta3, 7.24.2, 7.23.4, or 6.49.21. After updating, check the logs for the device compromise message and the ‘Flagged’ marker using /system/device-mode/print. Also, verify the configuration for unknown users, scripts, and other unrecognized changes. If immediate patching is not possible, disable exposed services or block access to them from untrusted networks. This applies in particular to SSH, WWW/WWW-SSL, and the bandwidth-test server. If compromise is indicated by the ‘Flagged’ marker, logs, or configuration, the device should be isolated from the network and, before performing a reset, its logs should be secured along with the configuration. After the material has been secured, the device should be restored to factory settings and reconfigured based on a trusted and verified configuration, and the passwords, keys, and other secrets in use should be changed. 🔧

For more details, Read full article!