Critical MikroTik RouterOS Flaws Under Active Exploitation
Network equipment maker MikroTik has released urgent patches for six vulnerabilities found in its RouterOS, with two of these flaws confirmed to be under active exploitation. The exploited vulnerabilities, collectively dubbed ‘MikroTrick’ by CERT Poland, allow attackers to bypass authentication and gain full control over affected devices, posing a significant risk to network infrastructure. According to SecurityWeek, MikroTik strongly recommends immediate patching, directing users to CERT Poland’s advisory for further details.
Technical Analysis of MikroTrick Exploitation
CERT Poland has confirmed that two specific vulnerabilities, CVE-2026-67276 and [CVE-2026-86060), are being chained together for in-the-wild attacks. CVE-2026-67276, with a CVSS score of 9.2, is an SSH authentication bypass bug, while CVE-2026-86060, also rated 9.2, concerns SSH session privilege manipulation. The combination of these flaws enables attackers to achieve complete control over MikroTik devices with SSH services exposed to public networks.
Exploitation of these ‘MikroTrick’ bugs has been observed since at least September 2, with attackers creating a new account named ‘ops’ on compromised routers. The observed attacks have originated from specific IP addresses: 82.192.72.4 and 103.102.31.18. The presence of these artifacts indicates potential successful exploitation and warrants immediate investigation, even though their absence does not definitively rule out unauthorized activity.
Beyond the actively exploited flaws, MikroTik’s update also addresses several other significant vulnerabilities:
- CVE-2026-67277: A memory disclosure and denial-of-service weakness (CVSS score 8.8).
- CVE-2026-67278: Enables TLS server impersonation.
- CVE-2026-67279: Allows unauthenticated attackers to tamper with files, including critical configuration files.
- CVE-2026-67281: Facilitates the disclosure of root-owned files, including configuration stores.
The widespread exposure of MikroTik devices amplifies the threat. The Shadowserver Foundation, in a 24-hour scan on September 5, identified over 120,000 MikroTik devices with SSH accessible from the internet, indicating a substantial attack surface for these critical vulnerabilities.
Patching MikroTik RouterOS: Urgent Guidance
Given the active exploitation and the severity of the vulnerabilities, immediate action is paramount for defenders. Organisations must prioritize applying the latest security updates to their MikroTik routers to prevent compromise.
How to Detect MikroTrick Exploitation and Remediate
Defenders should implement the following recommendations to mitigate the risk and address potential compromises:
- Immediate Patching: Update MikroTik routers to the latest RouterOS versions as soon as possible. The recommended versions are 7.25beta3, 7.24.2, 7.23.4, or 6.49.21. This specific guidance for MikroTik RouterOS critical vulnerability patching is the most crucial step.
- Restrict SSH Access: Block SSH access from untrusted or public networks. Limiting exposure is a foundational security practice that can significantly reduce the attack surface for this and similar threats.
- Monitor Logs: Regularly check router logs for a ‘Flagged’ entry, which MikroTik states indicates a compromised device. Also, look for the creation of an unexpected ‘ops’ user account.
- Investigate Indicators of Compromise (IoCs): Scrutinize network traffic and logs for connections to the IP addresses 82.192.72.4 and 103.102.31.18, which have been linked to active exploitation attempts. While the absence of these traces does not guarantee security, their presence requires immediate action.
- Network Perimeter Review: Conduct an audit of your network perimeter to ensure that no critical services, especially SSH, are inadvertently exposed to the internet. Minimizing exposure is key to preventing external actors from exploiting vulnerabilities like the CVE-2026-67276 SSH authentication bypass.
Proactive patching and rigorous network hygiene are essential to safeguard MikroTik infrastructure against ongoing and future threats.
Related: VMware Critical Flaws: Auth Bypass, RCE, VM Escapes Patched, MikroTik RouterOS Unauthenticated SSH Exploit: Critical Advisory