The Secure Shell (SSH) remote-access service of MikroTik routers is actively being used by attackers to access internet-exposed MikroTik routers, exploiting vulnerabilities that can grant complete administrative control without requiring authentication. A CERT Polska advisory published on September 5, stating that successful exploitation has been observed since at least September 2. The advisory also noted successful exploitation of the ongoing attacks.
In the advisory, the attackers were not identified or an estimate of how many devices had been compromised was not provided. In addition to warning of active exploitation, Costin Raiu also reported that MikroTik routers with SSH exposed may already be compromised. Known as MikroTrick, this attack chain is comprised of two vulnerabilities found in MikroTik RouterOS.
A CVSS rating of 9.2 has been assigned to CVE-2026-67276, an SSH authentication bypass vulnerability. A second vulnerability, CVE-2026-86060, allows privilege escalation within an SSH session. When combined, these flaws allow an attacker with no credentials to gain complete control of RouterOS devices that are affected by these flaws. RSA public key validation is the cause of CVE-2026-67276.
Using a legitimate username and public key, an attacker can construct a fake key that is accepted without possessing the associated private key. Once access has been gained, a privilege-escalation flaw can be used to elevate the session to administrative level control. The CERT Polska website stated that six RouterOS vulnerabilities have been identified and coordinated for disclosure, with two of these vulnerabilities involving MikroTrick.
Organizational members have observed the attack on RouterOS devices accessible directly from the Internet. MikroTik has released fixed RouterOS versions that address these vulnerabilities. CERT Polska recommends installing the appropriate security updates immediately, and reviewing router configurations for unauthorized modifications following that.
As stated in the vendor's documentation, home devices' default firewall rules normally prevent external access to management services as long as those rules are not altered. Evidence of exploitation emerged before the security fixes were widely announced. The successful attacks, including the creation of highly privileged accounts known as "ops," are believed to have begun at least at the beginning of September, CERT Polska stated.
A security researcher, Costin Raiu, noted that MikroTik released fixes on September 3, posing questions regarding whether attackers were aware of the patches before they were made public. The timeline does not conclusively establish the flaws as zero-days. In the case of the attacks, the IP address associated with Leaseweb 82.192.72.4 has been primarily linked. There was also an observation of a second address, 103.102.31.18, exploiting MikroTrick. The confirmed successful attacks originating from this address, according to CERT Polska.
A number of traces have been left in RouterOS logs. Failed exploitation attempts appear under the username “-2”, while successful activity may appear as a configuration change and SSH session. It has been confirmed that the creation of the “ops” account is related to the observed attacks. Any changes involving users, SSH keys, scripts, scheduled tasks, firewall rules, proxy servers, or tunnels should be investigated immediately. It remains difficult to determine the extent of the exposure.
Approximately 122,500 MikroTik devices exposed to the Internet over SSH were reported by ShadowServer Foundation on September 5, however this number does not reflect how many devices are vulnerable to specific MikroTik vulnerabilities. MikroTik has not disclosed the number of compromised or exploitable routers. The new RouterOS versions include a Flagged mechanism which detects signs of unauthorized configuration changes during startup of the operating system.
The system can be configured to disable suspicious entries and record a critical warning, but according to CERT Polska, the detection mechanism only detects known traces, so a router without a Flagged warning cannot be regarded as automatically clean.
Administrators unable to patch immediately should disable externally accessible SSH, WWW/WWW-SSL, and bandwidth test services or restrict access to trusted management networks. Additionally, CERT Polska recommends that unpatched devices do not make outbound TLS connections or use the built-in RouterOS SSH clients, particularly across untrusted networks. These measures are intended only to reduce exposure until the security update can be installed.
When a router shows signs of compromise, CERT Polska suggests isolating it and conserving its logs and configuration before performing a reset. When the router has been restored to factory settings, it should be rebuilt using a trusted configuration, while passwords, SSH keys, and other credentials should be rotated.
Restoring a potentially compromised backup without verifying it should never be done. It is important to note that the six vulnerabilities identified by CERT Polska extend beyond the SSH flaws, affecting areas such as bandwidth testing, certificate handling, and WebFig functionality. Among the high severity bandwidth-test flaws identified by the agency are CVE-2026-67277, which can expose kernel memory or cause a remote system crash.
The active exploitation highlights the risks of exposing router management services to the internet. RouterOS security updates should be applied by administrators, configurations should be reviewed for unauthorized changes, and affected devices should be examined for signs of compromise.
