MikroTik RouterOS: attackers take over routers with exposed SSH, update now

What happened

On September 3, 2026, MikroTik released security updates for RouterOS, the operating system that runs its routers. At first the company deliberately held back the details to give administrators time to update. The flaws were found by CERT Polska, the Polish national security team. On September 5, 2026, it published the details and named the attack that combines two of them “MikroTrick”.

Both flaws are in the SSH login, the remote command line of the router. The first, CVE-2026-67276, lets someone log in as an existing user without that user’s private key. The second, CVE-2026-86060, lets a specially crafted username obtain more rights than the account should have. According to CERT Polska and the Slovak SK-CERT, together they give an attacker full control of the device without logging in if the device allows remote access over SSH.

Attacks are already under way. CERT Polska confirmed successful attacks on routers with SSH reachable from the internet since at least September 2, 2026. The US agency CISA added CVE-2026-86060 to its catalog of exploited vulnerabilities on September 10, 2026, and the Slovak SK-CERT has also issued a warning. MikroTik and CISA also list another SSH flaw from the same report as exploited, CVE-2026-67279. According to MikroTik, it allows commands to be run without logging in. CISA added it to the catalog on September 25, 2026, and it is fixed in the same versions. On October 6, 2026, MikroTik updated its bulletin to list all six issues from the original report.

Why it is dangerous

The first flaw is in how the key is checked at login. Picture a doorman who checks only the photo on an ID card and never the name. When a user logged in with an RSA key, RouterOS did not compare the whole public key, only part of it. A public key is not a secret, so an attacker who knew the username and that user’s public key could log in without the private key. The attacker then had the rights of that account.

The second flaw is a classic input-handling bug, where a program treats part of a text as an instruction. A username starting with a prohibited character changed the rights the system gave to the session. The result was a session with full administrator rights.

The attack works over the internet with no password and no action from any user. The attacker needs to reach the router’s SSH port. For the MikroTrick chain, according to CERT Polska, the attacker must also know a username and the RSA public key of that account. Whoever controls the router can change its entire configuration. The attacks created a highly privileged account, and CERT Polska advises looking for unknown scripts, scheduled tasks, proxy servers and tunnels as well.

The NVD database rates CVE-2026-86060 at 9.8 out of 10 (critical) and CVE-2026-67276 at 8.1 (high) under CVSS 3.1. NVD gives CVE-2026-67279 a score of 6.5. CERT Polska and the Slovak SK-CERT give CVE-2026-86060 and CVE-2026-67276 a score of 9.2. The CISA KEV catalog lists only flaws that are proven to be exploited in real attacks. The EPSS score estimates the chance of exploitation in the next 30 days. It is 6.4% for CVE-2026-86060 and 8.9% for CVE-2026-67276, higher than for 93% and 95% of known vulnerabilities respectively.

Who is affected

This affects routers and other MikroTik devices running RouterOS. They are used by internet providers, businesses and households, and according to the Slovak SK-CERT, several million of them are in use worldwide. These versions are vulnerable:

RouterOS 6 before version 6.49.21
RouterOS 7, long-term channel, before version 7.23.4
RouterOS 7, stable channel, before version 7.24.2

According to the NVD record, CVE-2026-67276 affects only RouterOS 7. The devices most at risk are those with SSH reachable from the internet, for example for remote management. MikroTik also advises against exposing the WebFig web interface to the internet, as it has another flaw from the same report. The MikroTik default configuration blocks these ports from the internet. MikroTik says most configurations are not at risk and regular home users face no immediate risk, but it still recommends that everyone update.

How to check if you are affected

You can find the version in WinBox or WebFig under System > Packages, or in the router terminal. The commands below only read information and change nothing.

/system resource print

This command shows which services are enabled and from which addresses they can be reached. If SSH (ssh) or the web interface (www, www-ssl) is not limited to trusted addresses and the firewall does not block it, it may be reachable from the whole internet.

/ip service print

On RouterOS 7, check after updating whether the device shows the “Flagged” status (the flagged line). RouterOS 6 does not report this value.

/system device-mode print

How to fix it

The fixes are in RouterOS 7.24.2 (stable), 7.23.4 (long-term), 6.49.21 and the 7.25beta3 test release. However, 7.24.2 and 7.23.4 contained an incomplete fix for another flaw from the same report (CVE-2026-67278), so MikroTik and CERT Polska recommend going straight to newer versions:

RouterOS 7, stable channel: 7.24.3 or later
RouterOS 7, long-term channel: 7.23.6 or later
RouterOS 6: 6.49.21 or later

Start with devices that have SSH or WebFig reachable from the internet. Steps:

Back up and export the configuration and store it outside the router.
Make sure the device will not lose power during the update and has enough free storage.
Under System > Packages, click Check For Updates, choose your channel (stable or long-term) and install the update with Download&Install.
If you updated to 7.24.2 or 7.23.4 in September, update again.
After the reboot, check the log and configuration as described in the next part.

In the terminal, these commands do the same. The second one downloads and installs the update and reboots the router.

/system package update check-for-updates
/system package update install

Until the update is installed, disable SSH, WWW/WWW-SSL and the bandwidth-test server, or allow access to them only from trusted management networks. If you manage the device through these services yourself, make sure you have another way in first so you do not lock yourself out. Do not start TLS connections from the router and do not use the built-in SSH client (/system ssh, /system ssh-exec). Ideally, do not open management ports to the internet at all and use a VPN such as WireGuard for remote management. These are only temporary measures and do not replace the update.

The RouterOS 6 branch is no longer actively developed and MikroTik recommends moving to version 7. Some administrators reported problems with VPN tunnels after updating to 6.49.21, so allow time for testing on critical devices.

What if you may already be compromised

At startup, the fixed versions scan the configuration, disable recognized suspicious settings, write a critical message to the log and set the “Flagged” status. They catch only some traces, so a missing flag does not mean the device is clean. CERT Polska and the Slovak SK-CERT list these signs of attack:

an unknown highly privileged user, especially ops
unknown scripts, scheduled tasks, proxy servers and tunnels
the files ftpsrv.py, launch.sh and serve.py
connections from 82.192.72.4 or 103.102.31.18
log entries like these:

login failure for user -2 from <ip> via ssh
user <name> added by ssh:-2@<ip>

These commands only read data. They list users, SSH keys, scripts, scheduled tasks, proxies, interfaces including tunnels, files and relevant log entries. A log kept in the router’s memory is wiped on reboot.

/user print detail
/user ssh-keys print
/system script print
/system scheduler print
/ip proxy print
/ip socks print
/interface print
/file print
/log print where topics~"critical"
/log print where message~"user -2|ssh:-2"

If you find any of these, treat the router as compromised. Disconnect it, secure the logs and a configuration export, and only then reset it to factory settings. Do not clear the “Flagged” status before the analysis. Rebuild it from a verified configuration, not from a backup of the compromised device, and change all passwords and keys. Report the incident to SK-CERT in Slovakia or to CSIRT.CZ or NÚKIB in the Czech Republic. For a business network, bring in an expert, as the attacker may have moved further.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.