Hackers are actively exploiting two critical MikroTik RouterOS flaws to take control of internet-exposed routers. The attack chain targets devices that make their SSH services accessible through public networks.
Poland’s CERT agency discovered the vulnerabilities with assistance from GPT-5.5-cyber and GPT-5.6-sol. Researchers named the exploit chain “MikroTrick” and confirmed that attackers are already using it in real-world campaigns.
MikroTik released security updates on September 3. However, more than 122,000 MikroTik devices had exposed SSH interfaces as of September 5.
Attack chain bypasses SSH authentication
The first vulnerability, CVE-2026-67276, allows attackers to bypass SSH authentication. It stems from incomplete validation of RSA public keys in RouterOS.
To exploit the flaw, an attacker needs a valid username and the public modulus of that user’s key. The attacker can then create a different key and log in without possessing the legitimate private key.
The second vulnerability, CVE-2026-86060, allows SSH privilege escalation. RouterOS fails to handle specially crafted usernames correctly, enabling an attacker to manipulate an SSH session.
When hackers combine the two flaws, they can bypass authentication and gain full administrative control of the router.
Poland’s CERT said it had recently observed attacks against internet-accessible RouterOS devices. The agency also confirmed that attackers used the vulnerability chain to compromise routers with publicly exposed SSH services.
Third vulnerability can crash routers
Researchers also disclosed a third RouterOS vulnerability, tracked as CVE-2026-67277. This flaw affects the platform’s bandwidth-test service.
An unauthenticated attacker can exploit it to leak kernel memory remotely. Alternatively, the attacker can crash or restart the targeted router.
MikroTik patched all three vulnerabilities in RouterOS versions 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. Poland’s CERT subsequently tested and validated the fixes.
The vendor said certain configurations are not vulnerable. However, it withheld further technical details to give customers more time to update their devices.
Updates add compromise detection
The latest RouterOS updates also introduce a mechanism that checks for known signs of unauthorized configuration changes during startup.
If the system detects malicious entries, it disables them and records a critical warning. Nevertheless, Poland’s CERT warned that the absence of this marker does not prove that a router remains secure.
Indicators of compromise include unusual SSH login failures involving the username “-2.” Administrators should also investigate logs showing that SSH created a new user.
Another warning sign is the presence of an unexpected account named “ops” with extensive privileges.
Researchers linked the IP address 82.192.72.4 to confirmed successful attacks. They also observed 103.102.31.18 attempting to exploit the MikroTrick vulnerability chain.
Compromised routers require a full rebuild
Organizations that suspect a breach should immediately isolate the affected router. They should also preserve its logs and configuration for further investigation.
Poland’s CERT then recommends resetting the device to factory settings and rebuilding it from a trusted configuration. Administrators should rotate passwords, SSH keys and any other secrets stored on or used by the router.
Organizations that cannot patch immediately should restrict or disable externally accessible SSH, web administration and bandwidth-test services. In addition, they should avoid using the built-in SSH clients or outbound TLS connections over untrusted networks.
The Shadowserver Foundation counted approximately 122,500 MikroTik devices with exposed SSH interfaces on September 5. However, researchers have not determined how many of those devices remain vulnerable to the MikroTik RouterOS flaws.
0 responses to “Hackers exploit MikroTik RouterOS flaws to hijack routers”