MikroTrick: MikroTik routers taken over via exposed SSH

If there is a MikroTik router between your office and the internet, go look at it now. CERT Polska disclosed six MikroTik RouterOS vulnerabilities on September 5, and two of them chain into full, unauthenticated control of the device over SSH. The chain has a name — MikroTrick — and it has been used in real attacks since at least September 2. Patched versions are 6.49.21, 7.23.4, and 7.24.2.

What actually happened

The chain is two bugs, both scored CVSS 9.2 by CERT Polska:

• CVE-2026-67276 — improper RSA public key verification. An attacker who knows an authorized RSA modulus can supply a key with exponent one and forge a valid signature. That is the SSH authentication bypass.
• CVE-2026-86060 — argument injection through a crafted SSH username, which escalates the resulting session to full privileges.

Bypass the auth, escalate the session, own the router. No credentials required. The other four cover a WebFig unauthenticated file read that discloses root-owned config stores containing credentials (CVE-2026-67281), a bandwidth-test memory disclosure and kernel restart (CVE-2026-67277), and two more certificate-verification failures.

The indicators are unusually clean. CERT Polska reports the attacks leave this in the RouterOS log:

login failure for user -2 from <ip> via ssh
user <name> added by ssh:-2@<ip>

Look for the literal string ssh:-2@ and for a highly privileged account named ops. Successful compromises came from 82.192.72.4; attempts also came from 103.102.31.18. MikroTik published its advisory on September 3 without CVE detail, deliberately, to buy customers time — and RouterOS now self-scans on upgrade and flags devices it thinks were touched. Check with /system/device-mode/print.

Why a router CVE matters for your business

Because the router is the one box nobody owns. It was configured once, by whoever set up the office, and it has been forwarding packets ever since. Small businesses run MikroTik precisely because it is cheap and capable — the same reason it is sitting on a public IP with SSH open, three RouterOS versions behind.

A compromised edge router is not a network problem, it is a credential problem. Whoever holds it sees unencrypted internal traffic, rewrites DNS, adds a scheduler task that survives your next reboot, and reads the config store where your VPN keys live. That is why CERT Polska's guidance for a suspected compromise is factory reset and rebuild from a known-good config, not "remove the bad user." An attacker with a week inside RouterOS has had a week to leave something behind.

Three things today. Patch to 6.49.21, 7.23.4, or 7.24.2. Grep the logs for ssh:-2@ and enumerate your users. Then close SSH and WebFig to the public internet entirely — restrict them to a management VLAN or a VPN, which is where they should have been before any of this. We wrote the same thing when cheap LTE routers shipped with implants and when an ISP router exposed the whole LAN. The pattern does not change.

Sources: CERT Polska — actively exploited RouterOS vulnerabilities, CERT Polska — CVE details, MikroTik security advisory.