Summary
- CERT Polska has confirmed active exploitation of newly disclosed MikroTik RouterOS vulnerabilities.
- A two-flaw chain can bypass SSH authentication and reach full administrative control where SSH is exposed publicly.
- Patched RouterOS releases are available, but absence of MikroTik's Flagged marker does not prove a device was untouched.
Attackers are actively exploiting newly disclosed vulnerabilities in MikroTik RouterOS to take control of internet-accessible devices, according to Poland’s national computer emergency response team.
CERT Polska disclosed six vulnerabilities on 5 September after identifying the issues through its own research and coordinating fixes with the network-equipment vendor. The most serious attack path combines two flaws in a chain the researchers have named MikroTrick.
Where a RouterOS device exposes SSH to public networks, CERT Polska said the chain can allow an attacker to bypass authentication and ultimately obtain full administrative control of the router.
The six vulnerabilities span components including the SSH server and client, the bandwidth-test service, X.509 certificate handling, and the WebFig management interface. One critical issue, CVE-2026-67276, concerns incomplete validation of RSA public keys during SSH authentication.
A second flaw, CVE-2026-86060, concerns specially crafted usernames and can manipulate SSH session privileges. CERT Polska said combining the relevant issues forms the MikroTrick chain being used in real attacks.
The researchers confirmed exploitation against RouterOS devices whose SSH services were reachable from public networks. Successful attacks observed so far had been taking place since at least 2 September, and CERT Polska said the released patches stop the technique it has observed.
MikroTik has issued fixed releases including RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. CERT Polska recommends updating and then inspecting devices for unauthorised users, scripts, scheduler tasks, proxies, tunnels, and other unexpected changes.
The incident goes beyond the usual disclosure cycle in which a vulnerability becomes public before exploitation has been established. Routers occupy a privileged position in organisational infrastructure: compromise can provide durable network access, control over configuration, traffic visibility, or a platform from which to reach other systems.
Exposure is also difficult to reduce to a software-version check once attacks have started. A router can be updated after an attacker has already created an account, changed a scheduled task, established a tunnel, or altered another configuration element. Patch status and compromise status are therefore separate questions.
MikroTik has introduced a mechanism that scans the RouterOS configuration during start-up for recognised signs of unauthorised change. Where it identifies selected suspicious entries, it can disable them, write a critical log message, and set the device’s Flagged marker.
CERT Polska cautioned that the mechanism only detects selected traces. An unflagged router cannot therefore be assumed to be clean, while a flag should be treated as evidence that further investigation is required rather than proof of which individual vulnerability was exploited.
That distinction is particularly relevant for network appliances, which frequently remain in service for long periods and can sit outside conventional endpoint-monitoring coverage. Remote management interfaces can also be treated as an operational necessity, creating persistent exposure when they are reachable from public networks.
The disclosure illustrates the value of coordinated research before public technical detail becomes widely available. CERT Polska deliberately limited the information it published and did not release exploit code or details it believed would make automated attacks easier.
With exploitation already confirmed, organisations now face two separate tasks: moving vulnerable devices onto fixed releases, and establishing whether any previously exposed routers show signs of unauthorised modification. The first closes the known attack path; the second determines whether an attacker arrived before it was closed.
