Critical MikroTik RouterOS Vulnerabilities under Active Exploitation (MikroTrick)

Last update: 11 September, 2026

Tags: Security Bulletin

Adam Skupien, Vulnerability Security Analyst

Published: Friday 11 September 2026

Prepared by: Adam Skupien, Vulnerability Security Analyst

Summary

Active exploitation of a two-stage attack chain dubbed "MikroTrick" (CVE-2026-67276 + CVE-2026-86060) has been confirmed against MikroTik RouterOS, allowing an unauthenticated attacker to obtain full administrative control of any device with SSH reachable from the internet. CISA added CVE-2026-86060 and a related unauthenticated flaw in the same disclosure, CVE-2026-67277, to its Known Exploited Vulnerabilities (KEV) catalog on 10 September 2026. Fixed builds have been available since 3 September 2026 - two days before CERT Polska's public disclosure on 5 September, and exploitation was already under way by that point.

RouterOS is widely deployed as edge and gateway equipment among ISPs and SMBs, and the Shadowserver Foundation counted over 122,500 internet-facing RouterOS SSH instances in a single scan window on 5 September. Any device that has had SSH exposed to the internet should be treated as a suspected compromise, not just an overdue patch. The fixed builds do include a startup check for known MikroTrick traces, surfaced as a "Flagged" status - but it only matches documented indicators, so a flagged result confirms compromise while a clean one doesn't rule it out. Either way, investigate.

Vulnerability details

Severity: Critical. CVE-2026-67276 and CVE-2026-86060: CVSS 9.2. CVE-2026-67277: CVSS 8.8.
Exploit status: CVE-2026-67276 + CVE-2026-86060 ("MikroTrick") confirmed under active exploitation since at least 2 September 2026 (CERT Polska), a day before patches existed. CVE-2026-67277 had no confirmed active exploitation reported at the time of disclosure, but is unauthenticated and remotely reachable and has since been added to the CISA KEV catalog along with CVE-2026-86060. Notably, CVE-2026-67276, the entry point for the confirmed takeover chain, has not.
Patch status: Fixed in RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable), released 3 September 2026 (also present in the 7.25beta3 development build). CERT Polska's coordinated public disclosure followed on 5 September.
Vulnerability type:
- CVE-2026-67276 - Improper verification of a cryptographic signature (CWE-347) in SSH public-key authentication.
- CVE-2026-86060 - Improper neutralization of argument delimiters in a command (CWE-88) in the SSH login helper.
- CVE-2026-67277 - Missing authentication for a critical function (CWE-306) in the bandwidth-test (btest) service.
Mechanism (CERT Polska technical analysis): RouterOS validates only the key type and modulus of an SSH RSA public key during authentication, not the exponent. Since signature verification uses the client-supplied key, an attacker who knows a valid username and that account's public modulus can submit a key with an exponent of one, forge a valid signature, and open an SSH channel as that user without ever holding the private key (CVE-2026-67276). From there, a username beginning with a prohibited character is mishandled by the SSH login helper, letting the session alter its trusted policy mask and escalate to full administrative rights (CVE-2026-86060). Separately and independently of this chain, RouterOS accepts a "related" btest connection before the primary session finishes authenticating, letting an unauthenticated client leak kernel memory or trigger a kernel restart via a packet-size integer underflow (CVE-2026-67277).

Affected systems

Product	Affected Version(s)	Fixed Version
RouterOS (6.x branch)	6.0.0 - 6.49.20	6.49.21 (Long-term)
RouterOS (7.x branch, pre-7.24)	7.0.0 - 7.23.3	7.23.4 (Long-term)
RouterOS (7.24.x branch)	7.24 - 7.24.1	7.24.2 (Stable)

All three CVEs share the same affected and fixed version ranges.

Impact

Successful exploitation of the MikroTrick chain (CVE-2026-67276 + CVE-2026-86060) gives an unauthenticated attacker full administrative control of the device, enabling:

Interception or manipulation of all traffic passing through the device.
Use of the device as a pivot point for lateral movement into the internal network.
Access to any credentials, VPN keys, or firewall/NAT configuration stored on the device.
Persistence via configuration or user changes that survive a reboot.

CVE-2026-67277 (independent of the chain above) allows an unauthenticated attacker to leak kernel memory or force a kernel restart/crash on the device.

Mitigation actions

Patch immediately to RouterOS 6.49.21 / 7.23.4 / 7.24.2 (or later) - this single update addresses all three CVEs.
If immediate patching isn't possible: restrict SSH, WWW/WWW-SSL, and the bandwidth-test service to trusted management networks, or disable public exposure entirely in favour of an out-of-band or VPN path. This should be standard practice regardless of patch status, not just an interim step - but it reduces exposure, it does not remove the need to patch. Apply the fix as soon as possible regardless.
Given confirmed pre-disclosure exploitation, treat this as a compromise assessment, not just a patch task - assume any device that has had SSH exposed to the internet may already be affected, and check for the indicators below before/alongside patching.
If a third party manages the device (e.g. ISP-supplied CPE or an outsourced network provider):
- Confirm ownership and responsibility, then request evidence of the patch level (the running version number), not just verbal assurance.
- Set a follow-up deadline given active exploitation is confirmed; escalate an unresponsive provider through account management.
- Apply compensating controls on infrastructure you do control - tighten internal segmentation behind the device and increase monitoring for lateral movement or unusual traffic originating from it.
- Use this as a trigger to confirm what patching SLA, if any, exists for that equipment going forward.

Detection capabilities

Indicators of compromise

Unrecognised SSH accounts, notably a highly privileged user named ops, or usernames beginning with a prohibited character (e.g. -2).
The "Flagged" marker in the output of /system/device-mode/print - CERT Polska and MikroTik both note this catches only known attack traces; the absence of the marker is not proof the device is safe.
Traffic from confirmed attacker infrastructure: 82.192.72.4 (confirmed successful attacks, including creation of the ops account, since at least 2 September) and 103.102.31.18 (used in exploitation attempts).

If compromise is suspected

Isolate the device immediately.
Assume full administrative compromise - rotate all credentials and keys stored on the device (admin passwords, VPN pre-shared keys, RADIUS/LDAP secrets).
Review the configuration for unknown users, scripts, or other unrecognised changes, then patch.
Rebuild/re-image onto a fixed RouterOS build rather than relying on patching alone to remove any implant already present.

MDR customers: Triskele Labs is actively tuning detections for behaviour consistent with exploitation of the MikroTrick chain across supported log sources.

Vulnerability Management customers: Environments are being assessed for exposed and vulnerable MikroTik RouterOS instances; any exposure will be communicated through priority channels.