Affected Systems
MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH services exposed to the internet are at immediate risk. Approximately 122,500 MikroTik devices have exposed SSH interfaces as of September 5, 2026.
Exploitation Status
Active exploitation confirmed in the wild. Poland's CERT has observed attacks exploiting the CVE-2026-67276 (SSH authentication bypass) and CVE-2026-86060 (SSH privilege escalation) vulnerability chain, dubbed "MikroTrick," to take full control of exposed devices. IP addresses 82.192.72.4 and 103.102.31.18 linked to confirmed attacks.
Business Impact
Attackers can achieve full administrative control of MikroTik routers with internet-exposed SSH services by chaining an authentication bypass (CVE-2026-67276) with a privilege escalation flaw (CVE-2026-86060). This enables complete device takeover, configuration manipulation, and potential network pivoting. A third vulnerability (CVE-2026-67277) in the bandwidth-test service allows unauthenticated kernel memory leaks or remote device crashes. MikroTik has deployed compromise-detection mechanisms in patched versions, but absence of indicators does not guarantee device integrity.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update MikroTik RouterOS to version 7.25beta3, 7.24.2, 7.23.4, or 6.49.21 released September 3, 2026
- Restrict or disable SSH, WWW/WWW-SSL, and bandwidth-test services accessible from the internet until patching is complete
- Search logs for IoCs: login failures for user '-2', user additions by 'ssh:-2@
', and presence of unauthorized 'ops' accounts - Block inbound traffic from 82.192.72.4 and 103.102.31.18 at perimeter firewalls and monitor for connection attempts
- If compromise is suspected, isolate the router, preserve logs and configuration, factory-reset the device, rebuild from trusted configuration, and rotate all passwords and SSH keys