Affected Systems

MikroTik RouterOS all versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH service exposed to the internet are at highest risk. Six vulnerabilities identified, two critical (CVE-2026-67276, CVE-2026-86060) enable full device takeover without authentication when chained.

Exploitation Status

Active exploitation confirmed since at least September 2, 2026. Attackers are chaining CVE-2026-67276 (SSH authentication bypass) and CVE-2026-86060 (SSH privilege escalation) to gain full administrative control of internet-exposed devices. Attack infrastructure identified: 82.192.72.4 (confirmed successful attacks, creates "ops" user) and 103.102.31.18 (exploitation attempts).

Business Impact

Attackers gain full administrative control of compromised RouterOS devices, enabling network traffic interception, lateral movement, persistent backdoor installation, and use of devices as attack infrastructure. CERT Polska confirms patches block observed attacks. MikroTik deployed emergency push notifications to mobile app users. Devices may be flagged by vendor-implemented detection mechanism on reboot after patching, indicating prior compromise.

Urgency

🔴 Immediate

Recommended Actions

  • Update MikroTik RouterOS immediately to version 7.25beta3, 7.24.2, 7.23.4, or 6.49.21 depending on your branch.
  • After patching, check /system/device-mode/print for the 'Flagged' marker and review logs for 'login failure for user - 2 from via ssh' or 'user added by ssh : - 2' messages.
  • Audit RouterOS configuration for unauthorized users (especially 'ops'), scripts, scheduler tasks, proxy servers, and tunnels. Remove any unrecognized entries.
  • Block or restrict SSH access from the internet. If remote SSH is required, implement IP whitelisting or VPN-only access.
  • If 'Flagged' marker is present or compromise indicators found, assume full device takeover: perform factory reset, restore from known-good backup, rotate all credentials, and investigate network for lateral movement from the device's IP.

---

# Geopolitical Context

Geopolitical Context

The active exploitation of critical MikroTik RouterOS vulnerabilities represents a significant threat to global network infrastructure, particularly affecting small and medium enterprises, ISPs, and critical infrastructure operators that rely on widely deployed MikroTik devices. CERT Polska's disclosure of six vulnerabilities—including two critical flaws enabling full device compromise without authentication—highlights the strategic vulnerability of commercial networking equipment that underpins telecommunications and internet infrastructure across Europe, Asia, and emerging markets. MikroTik devices are extensively deployed in Eastern Europe, the former Soviet space, and developing regions due to their cost-effectiveness, making them attractive targets for both opportunistic cybercriminals and state-aligned actors seeking persistent access to network infrastructure. The exploitation pattern observed since at least September 2, 2026, involving specific IP addresses and the creation of privileged "ops" accounts, is consistent with reconnaissance or pre-positioning activity that could serve espionage, disruption, or future offensive cyber operations. The vendor's unprecedented use of push notifications and an automated "Flagged" compromise-detection mechanism underscores the severity and scale of the threat.

State Actor Alignment

While CERT Polska has not attributed the observed exploitation to any specific state actor, the targeting of network infrastructure devices is consistent with tactics employed by multiple intelligence services and state-aligned groups seeking persistent access for espionage or pre-positioning. The IP addresses identified in exploitation attempts (82.192.72.4 and 103.102.31.18) may warrant further investigation by national CERTs and intelligence agencies, though infrastructure attribution remains inconclusive without additional context. The strategic value of compromised routers—enabling traffic interception, man-in-the-middle attacks, and lateral movement into connected networks—makes such vulnerabilities attractive to state-sponsored actors across multiple threat landscapes, including those linked to Russia, China, Iran, and North Korea. No sanctions or policy measures are currently indicated, though the incident may prompt regulatory attention to network equipment security standards within the EU and NATO member states, particularly given Poland's geographic position and role in supporting Ukraine-related communications infrastructure.

Business Impacty pro region

The vulnerability disclosure carries significant implications for European telecommunications resilience and broader internet infrastructure security. MikroTik devices are particularly prevalent in Central and Eastern Europe, the Balkans, and post-Soviet states, where they serve as critical components of ISP networks, enterprise connectivity, and in some cases, government and municipal infrastructure. Poland's CERT leadership in identifying and coordinating disclosure reflects the country's growing role in regional cybersecurity, particularly as a frontline NATO state adjacent to the Russia-Ukraine conflict zone. Compromised routers in Poland, the Baltics, or Ukraine could facilitate intelligence collection on military logistics, refugee movements, or sanctions-evasion networks. Beyond Europe, MikroTik's market penetration in Latin America, Africa, and Southeast Asia means exploitation could enable broad surveillance or disruption campaigns affecting developing economies with limited cybersecurity capacity. The incident underscores the systemic risk posed by widely deployed commercial equipment and may accelerate European efforts to diversify network equipment suppliers and strengthen supply chain security, particularly in sectors designated as critical under the NIS2 Directive.

Forecast

If patching rates remain low among MikroTik operators—particularly in under-resourced ISPs and SMEs—the vulnerabilities are likely to be exploited at scale by both cybercriminal groups seeking botnet expansion and state-aligned actors pursuing persistent access for intelligence or pre-positioning. The identification of specific exploitation IP addresses and the "ops" account indicator suggests that threat intelligence sharing among national CERTs may enable broader detection and remediation efforts in the coming weeks. If the exploitation is linked to state actors, compromised devices may be leveraged for future operations coinciding with geopolitical events, such as elections, NATO activities, or escalations in the Russia-Ukraine theater. MikroTik's deployment of automated compromise detection may reduce dwell time for sophisticated actors, though the vendor's acknowledgment that unknown vulnerabilities may exist suggests the threat landscape remains fluid. Over the next three to six months, expect increased scrutiny of MikroTik deployments in critical infrastructure sectors, potential regulatory guidance from ENISA or national authorities, and possible inclusion of these vulnerabilities in adversary playbooks targeting European and allied networks. If exploitation scales significantly, it may prompt coordinated takedown efforts or sanctions targeting infrastructure used in the attacks.