Hackers are actively exploiting a chain of two recently disclosed vulnerabilities in MikroTik RouterOS to gain control of affected devices. The attack targets routers with SSH services exposed to the internet. The vulnerability chain allows attackers to hijack the routers remotely. MikroTik is a widely used networking equipment vendor, making this a significant threat to network infrastructure globally. Organizations using MikroTik routers with internet-facing SSH are at risk. The exploitation of chained vulnerabilities increases the severity of the threat. Users are advised to apply patches and restrict SSH access to mitigate risk.
Hackers are exploiting a chain of two vulnerabilities in MikroTik RouterOS dubbed 'MikroTrick' by Poland's CERT. CVE-2026-67276 is an SSH authentication bypass flaw caused by incomplete validation of RSA public keys; an attacker who knows a username and the public modulus of that user's RSA key can craft a different key and log in without the legitimate private key. CVE-2026-86060 is an SSH privilege escalation flaw caused by improper handling of specially crafted usernames, allowing an attacker to manipulate the SSH session to obtain full administrative privileges. A third flaw, CVE-2026-67277, affects the RouterOS bandwidth-test service and allows unauthenticated attackers to leak kernel memory or remotely crash/restart the router. Both critical CVEs were discovered by Poland's CERT with the assistance of GPT-5.5-cyber and GPT-5.6-sol. Exploitation targets devices with SSH services exposed to the internet. As of September 5, approximately 122,500 MikroTik devices had an exposed SSH interface according to ShadowServer. The patched versions include a compromise-detection mechanism that checks for unauthorized configuration changes at startup.
1. Apply security updates immediately: upgrade to RouterOS 7.25beta3, 7.24.2, 7.23.4, or 6.49.21 (released September 3). 2. If unable to patch immediately, restrict or disable externally accessible SSH, WWW/WWW-SSL, and bandwidth-test services. 3. Avoid using the built-in SSH clients and outbound TLS connections over untrusted networks. 4. Monitor logs for IoC entries: 'login failure for user -2 from <ip> via ssh' and 'user <name> added by ssh:-2@<ip>'. 5. Check for presence of a highly privileged 'ops' account. 6. Block or monitor traffic from IPs 82.192.72.4 and 103.102.31.18. 7. If compromise is suspected: isolate the router, preserve logs and configuration, perform a factory reset, rebuild from a trusted configuration, and rotate all passwords, keys, and secrets. 8. Note that absence of a compromise marker does not guarantee the router has not been compromised.
Log entry: 'login failure for user -2 from <ip> via ssh', Log entry: 'user <name> added by ssh:-2@<ip>', Presence of a highly privileged 'ops' account, IP: 82.192.72.4 — linked to confirmed successful attacks, IP: 103.102.31.18 — observed attempting to exploit MikroTrick
