Affected Systems

MikroTik RouterOS all versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH service exposed to the internet are at highest risk. Six vulnerabilities identified, two critical (CVE-2026-67276, CVE-2026-86060) enable full device takeover without authentication when chained.

Exploitation Status

Active exploitation confirmed since at least September 2, 2026. Attackers are chaining CVE-2026-67276 (SSH authentication bypass) and CVE-2026-86060 (privilege escalation via crafted username) to gain full administrative control of internet-exposed RouterOS devices. Attack infrastructure identified: 82.192.72.4 (confirmed successful attacks, creates "ops" user) and 103.102.31.18 (exploitation attempts). MikroTik issued emergency push notifications to mobile app users.

Business Impact

Attackers gain full administrative control of compromised RouterOS devices, enabling network pivoting, traffic interception, persistent backdoors, and use as attack infrastructure. Organizations with MikroTik routers exposed to the internet face immediate risk of compromise. The vendor has implemented a "Flagged" detection mechanism in patched versions that identifies known compromise indicators at boot, but absence of this flag does not guarantee device integrity. Third vulnerability (CVE-2026-67277, bandwidth-test service) enables memory disclosure and remote DoS without authentication.

Urgency

🔴 Immediate

Recommended Actions

  • Update all MikroTik RouterOS devices immediately to version 7.25beta3, 7.24.2, 7.23.4, or 6.49.21 depending on your branch
  • After patching, run /system/device-mode/print and check for 'Flagged' marker; review logs for 'login failure for user - 2 from via ssh' and 'user added by ssh : - 2 @' messages
  • Audit all RouterOS configurations for unauthorized users (especially account named 'ops'), scripts, scheduler tasks, proxy servers, and tunnels
  • Block or restrict SSH access from public networks; implement IP allowlisting for SSH management if remote access is required
  • If compromise indicators are found, assume full device takeover: perform factory reset, restore from known-good backup, rotate all credentials, and investigate lateral movement from the compromised device

---

# Geopolitical Context

Geopolitical Context

The disclosure of actively exploited vulnerabilities in MikroTik RouterOS—a widely deployed networking platform in small and medium enterprises, ISPs, and critical infrastructure globally—represents a significant supply-chain security event with potential cascading effects. MikroTik devices are particularly prevalent in Eastern Europe, the Balkans, and post-Soviet states, where they serve as cost-effective backbone infrastructure. CERT Polska's coordination of this disclosure and observation of active exploitation since at least September 2 underscores Poland's growing role as a regional cybersecurity hub and early-warning node within EU cyber defense architecture. The timing is notable given heightened threat activity targeting European telecommunications and energy sectors amid ongoing geopolitical tensions. The vulnerabilities—particularly the SSH authentication bypass chain dubbed "MikroTrick"—enable full device compromise without credentials, creating opportunities for network pivoting, traffic interception, and pre-positioning for disruptive operations. The vendor's unprecedented use of push notifications and automated "Flagged" compromise detection mechanisms reflects industry adaptation to accelerated threat timelines.

State Actor Alignment

No attribution to state actors is provided in the available data. The identified exploitation infrastructure (IP addresses 82.192.72.4 and 103.102.31.18) and observed tactics—creation of privileged "ops" accounts, configuration manipulation—are consistent with both state-sponsored reconnaissance operations and cybercriminal infrastructure compromise for botnet expansion or proxy networks. The targeting of SSH-exposed devices accessible from public networks suggests opportunistic scanning rather than precision targeting, though such access could facilitate subsequent strategic operations. CERT Polska's disclosure does not link the activity to any known advanced persistent threat (APT) group or national intelligence service. The vulnerabilities' criticality and the affected vendor's market penetration may attract attention from multiple state and non-state actors seeking persistent access to telecommunications infrastructure.

Business Impacty pro region

The exploitation of MikroTik devices carries significant implications for European network resilience. Poland's position as a NATO eastern flank state and critical transit hub for energy and data flows amplifies the strategic sensitivity of telecommunications infrastructure vulnerabilities. MikroTik's market share in Central and Eastern Europe, the Balkans, and former Soviet republics means compromised devices could provide footholds in networks supporting critical services, cross-border connectivity, and government communications. For EU member states, this incident reinforces the urgency of the NIS2 Directive's supply-chain security requirements and highlights gaps in visibility into small-to-medium enterprise (SME) network security posture. Globally, the vulnerabilities affect ISPs, wireless internet service providers (WISPs), and industrial control system (ICS) networks in emerging markets where MikroTik equipment is widely deployed due to cost considerations. The incident may prompt renewed scrutiny of network equipment diversity and dependency on single vendors in critical sectors, particularly in regions with limited cybersecurity capacity.

Forecast

If patching rates remain low among SMEs and underresourced network operators, exploitation is likely to expand beyond the initial observed campaigns, potentially enabling large-scale botnet recruitment or pre-positioning for disruptive operations. Should state-aligned actors adopt these techniques, compromised MikroTik devices could serve as persistent access points for espionage or as infrastructure for future destructive attacks targeting European telecommunications and energy sectors. If the "Flagged" detection mechanism proves effective and vendor push notifications drive rapid remediation, the window for mass exploitation may narrow within weeks; however, devices in poorly managed networks or conflict-adjacent regions may remain vulnerable for months. Continued observation of exploitation infrastructure and tactics will be critical to assess whether activity shifts from opportunistic scanning to targeted operations. If additional undisclosed vulnerabilities exist—as CERT Polska suggests cannot be ruled out—a second wave of exploitation targeting updated but still-vulnerable devices is possible.