“MikroTrick” Exploit Chain Targets SSH-Exposed MikroTik RouterOS Devices
According to CERT Polska, active exploitation of MikroTik RouterOS has been underway since at least September 2nd, 2026. The chain leverages CVE-2026-67276 (CVSS 9.2) and CVE-2026-86060 (CVSS 9.2) against devices whose SSH service is reachable from public networks. A successful breach yields full control of the targeted system. MikroTik has published fixes for the flaws in versions 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21. The same release cycle also patched CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, and CVE-2026-67281, although they were not included in the vendor’s advisory.
Two of the six vulnerabilities, CVE-2026-67277 and CVE-2026-86060, were added to CISA’s Known Exploited Vulnerabilities (KEV) list [1][2]. Although CERT Polska reports exploitation of CVE-2026-67276, it was not added to CISA’s KEV catalog. A technical analysis of the patched code is also available online [3]. Numerous national CERT agencies have issued alerts for the recent flaws affecting MikroTik RouterOS [4][5][6][7][8][9][10][11][12][13][14]. Users should update immediately to a patched version.
Detect These Vulnerabilities with Greenbone
The OPENVAS ENTERPRISE FEED includes remote banner detection for the CVEs leveraged in the MikroTrick exploit chain and other September 2026 CVEs affecting MikroTik RouterOS.
The ENTERPRISE FEED also includes regular detection for flaws affecting RouterOS. Recent threats include, CVE-2026-14227 and CVE-2026-16347 [1] (both have been issued CISA ICS Advisories [2][3]), CVE-2025-42611 [4], and CVE-2026-7668 [5].
A Risk Assessment of Attacks Targeting MikroTik RouterOS
RouterOS is MikroTik’s Linux-based network operating system for routers, switches, and wireless devices. The platform also includes built-in routing, firewall, VPN, wireless management, network monitoring, and other core networking functions. Exposure of RouterOS administrative services presents especially high-risk because a compromise could affect the network layer of an entire network segment or organization.
The disclosed exploit path, dubbed “MikroTrick”, allows unauthorized initial access via exposed SSH service. The vendor states that SSH should not be accessible on untrusted networks. Furthermore, the default RouterOS configuration blocks SSH from the WAN interface. If enabled and accessible on a local network, the vulnerable SSH service could also allow an attacker with network access, such as an insider attacker, to move laterally to a high-value target.
There is a discrepancy between CERT Polska’s observations and the CVEs that have been added to CISA’s KEV list. Fixes for all known vulnerabilities are available in RouterOS versions 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21. The availability of a public technical analysis for the RouterOS patch and a public exploit (PoC) toolkit for CVE-2026-67276 increases the risk of wider attack campaigns. CIRCL.lu’s Vulnerability Lookup indicates that discussion about a PoC for CVE-2026-86060 is taking place on Telegram [3]. This increases the risk that additional threat groups will weaponize the full MikroTik exploit chain.
The Technical Details for September 2026 MikroTik RouterOS Flaws
Here is a brief technical description for all new CVEs affecting MikroTik RouterOS:
The MikroTrick Attack Chain:
CVE-2026-67276 and CVE-2026-86060, the two vulnerabilities chained together in the MikroTrick exploit, each shown with its CVSS severity band and EPSS exploitation-probability score
An SSH authentication bypass in RouterOS allows login without a user’s private key. Exploitation grants an attacker the target account’s privileges. The root cause is incomplete RSA public-key verification [CWE-347] in the RouterOS SSH service. The flaw exists because the server checks the key type and modulus, but not the exponent. CVE-2026-67276 is considered actively exploited by CERT Polska and a PoC exploit is publicly available [1]. This issue affects only 7.x branch and was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable).
An SSH login argument-handling flaw [CWE-88] in which usernames beginning with a prohibited character can alter the trusted policy mask, leading to privilege escalation and a full administrative session. CVE-2026-86060 has been added to CISA’s KEV list. CIRCL.lu’s Vulnerability Lookup indicates that discussion about a PoC is taking place on Telegram [3]. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable).
Also added to CISA’s KEV list:
CVE-2026-67277, also added to CISA’s Known Exploited Vulnerabilities catalog, shown with its CVSS severity band and EPSS exploitation-probability score
A flaw in the bandwidth-test service allows an unauthenticated client to reach a post-authentication state and exploit packet-buffer disclosure and integer-underflow conditions. Exploitation allows an attacker to leak sensitive kernel memory or restart the device. The root-cause is classified as a missing authentication for a critical function [CWE-306]. CVE-2026-67277 has been added to CISA’s KEV list. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable).
Additional RouterOS flaws published in September 2026:
CVE-2026-67278, CVE-2026-67279, and CVE-2026-67281, the additional MikroTik RouterOS flaws patched in September 2026, each shown with its CVSS severity band and EPSS exploitation-probability score
An X.509 validation flaw [CWE-347] in TLS handling. Malformed RSA/PKCS#1 v1.5 signatures allow an attacker that controls or can redirect outbound TLS connections to forge a trusted intermediate certificate and impersonate arbitrary hostnames. This issue affects only 7.x branch and was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable).
A client-requested SSH rekey can move the connection into the session and exec path even though authentication was never attempted. Exploitation allows an unauthenticated attacker to conduct file creation, overwrite, and reconstruction in the RouterOS-managed file namespace. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable).
A file-read issue in the WebFig /jsproxy path allows an unauthenticated attacker to read root-owned files, including configuration stores containing credentials. The root cause is a stale uninitialized principal pointer [CWE-824] combined with parent-directory traversal [CWE-22]. This issue affects only 7.x branch and was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable).
Understanding the MikroTrick Exploitation Campaign
According to CERT Polska, the MikroTrick exploit chain allows an attacker to take full control of affected devices via the SSH service. The MikroTrick attack combines CVE-2026-67276 and CVE-2026-86060.
CVE-2026-67276 is leveraged first to bypass SSH authentication by abusing incomplete RSA public-key verification. This allows unauthenticated access without the target user’s private key. In the second stage, CVE-2026-86060 is used to manipulate SSH login argument handling so that a crafted username can alter the trusted policy mask to gain root-level permissions. The result is escalation from unauthorized SSH access to a full administrative RouterOS session. After obtaining full administrative access, attackers created a rogue local account named ops, with high-level privileges. Affected system logs recorded entries such as: user ops added by ssh:-2@<attacker-ip>.
CERT Polska has not publicly confirmed any other attacker techniques, but lists several observed attacker IP addresses. Defenders should be aware that the absence of known indicators does not rule out device compromise.
Mitigation for New CVEs Affecting MikroTik RouterOS
Patches for all CVEs discussed above are available in RouterOS versions 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21. For organizations with the SSH exposed for remote administration, remediation priority should be highest where it is reachable from public or otherwise untrusted networks. The OPENVAS ENTERPRISE FEED includes remote banner detection for the CVEs associated with the MikroTrick exploit chain and other new CVEs affecting MikroTik RouterOS.
For organizations that cannot apply the patches immediately, public SSH access should be disabled. MikroTik also warns that SSH should not be left open to untrusted networks and states that the default configuration blocks the service from the internet. Beyond patching, defenders should review devices for broad indicators of compromise.
Summary
MikroTrick is a newly disclosed exploit chain that combines CVE-2026-67276 with CVE-2026-86060 for full unauthenticated root-level control of RouterOS devices. The attacks leverage the exposed SSH service of vulnerable devices. CERT Polska believes that attacks have been active since at least September 2nd, 2026. CISA added CVE-2026-86060 and a separate flaw, CVE-2026-67277, to its KEV list. Additional risk is posed by public PoC exploit code and a detailed patch analysis.
Detect These Vulnerabilities with Greenbone
The OPENVAS ENTERPRISE FEED includes remote banner detection for the CVEs associated with the MikroTrick exploit chain and other new CVEs affecting MikroTik RouterOS. This includes the most recent batch: CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, and CVE-2026-86060. The vendor has released fixes for the affected RouterOS branches and has further advised administrators not to expose SSH to untrusted networks.
Joseph has had a varied and passionate background in IT and cyber security since the late 1980s. His early technical experience included working on an IBM PS/2, assembling PCs and programming in C++.
He also pursued academic studies in computer and systems engineering, anthropology and an MBA in technology forecasting.
Joseph has worked in data analytics, software development and, in particular, enterprise IT security. He specialises in vulnerability management, encryption and penetration testing.
