MikroTik Called It a Quiet Patch. CERT Polska Calls It “MikroTrick” — Full Admin Takeover With No Password and No Key, Exploited a Day Before the Fix Existed
IMMEDIATE ACTIONS — MIKROTRICK PRIORITY DIRECTIVES: (1) Patch every RouterOS device immediately to 6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable), or 7.25 beta 3 — fixes are live on all channels now. (2) Treat every internet-facing device with SSH enabled as a live incident, not a routine update — patching does not remove an attacker who already has admin access. (3) Audit accounts on every exposed router for anything unrecognized. One documented case: a rogue account named “ops” created by another rogue account labeled “0,” granted write and policy permissions. (4) Hunt for inbound SSH connections from 82.192.72.4 and 103.102.31.18. (5) Check the new “Flagged” status in the RouterOS Log section after upgrading — useful, but not a guarantee the device is clean. (6) Review scheduler entries, scripts, proxy settings, and tunnels for anything unexplained. (7) Restrict SSH exposure to the internet wherever operationally possible going forward. (8) Read CERT Polska’s full technical disclosure at cert.pl, including all six vulnerabilities and IOC/YARA hunting rules.
MikroTik shipped a patch on September 3 without publishing technical details, hoping to buy administrators time before attackers reverse-engineered the flaw. CERT Polska confirmed exploitation had already been running for a full day before that patch existed. Two chained SSH bugs, no credentials, no private key — full administrative control of any exposed RouterOS device. | DataWater Threat Brief, September 6, 2026
Sources: CERT Polska — “Critical vulnerabilities in MikroTik RouterOS are being actively exploited” and “Vulnerabilities in MikroTik RouterOS software” (primary disclosure, September 5, 2026) · Security Affairs — Costin Raiu’s technical breakdown of active exploitation · Cyber Security News — “Hackers Exploiting MikroTik RouterOS Vulnerability in the Wild” · AiCybr Blog — MikroTrick technical summary and hunting guidance · MikroTik’s own September 2026 security advisory | Attack chain: MikroTrick | Core CVEs: CVE-2026-67276 (CVSS 9.2) + CVE-2026-86060 (CVSS 9.2) | Vendor: MikroTik | Product: RouterOS, all channels | Patch released: September 3, 2026 | Exploitation observed since: September 2, 2026 | Disclosure: CERT Polska, September 5, 2026 | Impact: Full unauthenticated administrative takeover | Corroborating agency: Latvia national CERT
“If you have a MikroTik router on the internet with SSH open, it may already be compromised.” — Costin Raiu, security researcher. Exploitation began a full day before the patch existed. This is a true zero-day, not a disclosure race.
| Field | Detail |
|---|---|
| Attack chain | MikroTrick — two chained SSH vulnerabilities, named by CERT Polska |
| Core CVEs | CVE-2026-67276 (CVSS 9.2, SSH authentication bypass) + CVE-2026-86060 (CVSS 9.2, SSH privilege escalation) |
| Vendor / Product | MikroTik RouterOS, all release channels |
| Patched versions | 6.49.21 (Long-term) · 7.23.4 (Long-term) · 7.24.2 (Stable) · 7.25 beta 3 |
| Patch released | September 3, 2026 — issued without technical detail to slow reverse-engineering |
| Exploitation observed since | September 2, 2026 — one full day before the patch existed |
| Disclosure | CERT Polska, September 5, 2026 — six vulnerabilities total, two confirmed exploited |
| Attack vector | Unauthenticated SSH access on internet-exposed devices |
| Impact | Full administrative control — no credentials, no private key, no user interaction required |
| Additional disclosed CVEs (not confirmed exploited) | CVE-2026-67277 (CVSS 8.8, btest memory disclosure/crash) · CVE-2026-67278 (X.509 signature forgery enabling TLS impersonation via a legacy e=3 root CA) |
| Observed IOCs | Rogue account “ops” created by rogue account “0” · Inbound SSH from 82.192.72.4 and 103.102.31.18 |
| Corroborating advisory | Latvia’s national CERT — confirms a marked increase in attacks against MikroTik routers |
A quiet patch, a loud zero-day
On September 3, 2026, MikroTik pushed fixes across every RouterOS release channel while deliberately withholding technical detail — the advisory said plainly it was “not currently publishing detailed information” so administrators would have a head start before attackers could reverse-engineer the flaw. The head start never materialized. Community researchers pieced together the mechanics within days, and CERT Polska confirmed something worse: exploitation in the wild had already been running since September 2 — a full day before the patch existed anywhere. That timeline rules out a disclosure race. This was a genuine zero-day hitting production routers before any fix was available.
How MikroTrick actually works
CVE-2026-67276 — SSH Authentication Bypass (CVSS 9.2). RouterOS validates SSH public-key logins by checking the key type and modulus — but not the exponent. An attacker who knows a valid username and the public half of that user’s RSA key can forge a new key with exponent 1, produce a valid signature, and open an authenticated session without ever holding the private key.
CVE-2026-86060 — SSH Privilege Escalation (CVSS 9.2). A separate parsing flaw in how RouterOS handles usernames beginning with a prohibited character lets an attacker manipulate the session’s policy mask mid-login, escalating directly to full administrative rights.
Chained together: no credentials, no private key, no user interaction — complete admin control of any internet-facing RouterOS device with SSH enabled.
Why this matters for CISOs and SOC teams
RouterOS runs the network edge — branch routers, VPN concentrators, ISP infrastructure, industrial gateways. An unauthenticated admin-takeover chain at that layer isn’t an isolated device problem; it’s a foothold into everything the router touches: internal traffic, connected VPN tunnels, and any trust relationship built on the assumption that “the router is a router, not a server we actively monitor.” That blind spot matches a pattern seen across recent network-edge campaigns — attackers moving down the stack toward infrastructure that connects and authenticates, where logging is thinnest and dwell time is longest.
Detection indicators — what to hunt for right now
- Accounts: Unrecognized user accounts, especially ones created by other unrecognized accounts (observed pattern: account “ops” created by account “0”)
- Network: Inbound SSH connections from 82.192.72.4 or 103.102.31.18
- Configuration: Unexplained scheduler entries, scripts, proxy settings, or tunnels
- Post-patch: A device marked “Flagged” in the RouterOS Log section — MikroTik’s new compromise scanner. Treat as a signal, not a clean bill of health.
Related DataWater Coverage — Network Edge & Remote Access Infrastructure
- Citrix Patched It as “Just a Crash.” A JPMorgan Researcher and watchTowr Proved It’s Pre-Auth RCE. Now CISA Wants It Fixed by Saturday.
- Fire Ant: China-Linked Hackers Turn Cisco Routers Into Spying Platforms
- OAuth Consent Phishing: FBI Warns Attackers Are Bypassing Passwords and MFA Entirely — And a Password Reset Won’t Save You
Sources and further reading
- CERT Polska — Critical vulnerabilities in MikroTik RouterOS are being actively exploited
- CERT Polska — Vulnerabilities in MikroTik RouterOS software (full CVE writeups)
- Security Affairs — Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”
- Cyber Security News — Hackers Exploiting MikroTik RouterOS Vulnerability in the Wild
- AiCybr Blog — MikroTrick Is Actively Exploited: Update Guidance
- MikroTik — September 2026 Vulnerability Advisory
DataWater publishes daily cybersecurity intelligence for enterprise and government security leaders.
