Affected Systems

MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. All unpatched RouterOS devices with SSH enabled are vulnerable to unauthenticated remote takeover when CVE-2026-67279 and CVE-2026-86060 are chained together.

Exploitation Status

Active exploitation confirmed in the wild. Attackers created privileged 'ops' accounts before patches were released on September 3, 2026. CERT.PL has developed and validated a working proof-of-concept exploit chain.

Business Impact

Critical pre-authentication remote code execution allows complete device compromise without credentials. Attackers gain full administrative access to routers, enabling network interception, traffic manipulation, persistent backdoors, and lateral movement. MikroTik deployed specific IoC detection (Flagged mechanism checking for 'ops' accounts in 'full' group) indicating vendor awareness of active campaigns. Logs show failed login attempts for user '-2' followed by account creation from the same SSH session, bypassing all authentication.

Urgency

đź”´ Immediate

Recommended Actions

  • Immediately upgrade all MikroTik RouterOS devices to version 7.24.2, 7.23.4, 6.49.21, or later (7.25beta3 for beta branch)
  • Check RouterOS logs for failed login attempts to user '-2' and unauthorized 'ops' accounts created via SSH, particularly from IP 82.192.72.4 or similar suspicious sources
  • Verify no accounts exist in the 'full' privilege group that were not explicitly created by administrators; remove any unauthorized accounts immediately
  • Review RouterOS Flagged status at startup for automatic detection of 'ops' account IoC introduced in patched versions
  • Restrict SSH access to MikroTik devices using firewall rules limiting connections to trusted management networks only until patching is complete

---

# Geopolitical Context

Geopolitical Context

The disclosure of the MikroTrick vulnerability chain (CVE-2026-67279 and CVE-2026-86060) affecting MikroTik RouterOS represents a significant supply chain security event with broad implications for critical infrastructure. MikroTik routers are widely deployed globally, particularly in emerging markets and among small-to-medium enterprises, making them attractive targets for both state-sponsored and criminal actors. The vulnerability allows unauthenticated remote takeover, a capability consistent with tools used in espionage operations, botnet construction, and network infrastructure compromise. Evidence of in-the-wild exploitation prior to patch availability—including the creation of privileged "ops" accounts from IP address 82.192.72.4—suggests organized reconnaissance or pre-positioning activity. The vendor's introduction of specific indicators of compromise and urgent push notifications indicates awareness of active targeting. Poland's CERT.PL, operating within a NATO member state bordering Ukraine and the Kaliningrad exclave, maintains heightened vigilance regarding infrastructure vulnerabilities that could be leveraged in hybrid conflict scenarios or intelligence collection operations targeting European networks.

State Actor Alignment

No attribution to specific state actors is provided in the disclosure. However, the technical sophistication of chaining two vulnerabilities—one bypassing SSH authentication state handling (CVE-2026-67279) and another enabling argument injection through username validation (CVE-2026-86060)—is consistent with capabilities possessed by advanced persistent threat (APT) groups. The pre-patch exploitation observed in device logs may indicate either state-sponsored reconnaissance or criminal infrastructure development. MikroTik devices have historically been targeted by actors linked to Russia (including in operations attributed to Sandworm/GRU Unit 74455) and China, as well as by cybercriminal groups establishing proxy networks and botnet infrastructure. The coordinated vulnerability disclosure process between CERT.PL and MikroTik, and the vendor's rapid multi-branch patching response, reflects responsible security practices. No sanctions implications are apparent, though widespread exploitation of networking infrastructure could trigger policy discussions regarding supply chain security standards and mandatory vulnerability disclosure timelines within the EU's NIS2 Directive framework.

Business Impacty pro region

The vulnerability's impact extends well beyond Poland to affect global network infrastructure, with particular significance for Europe. MikroTik's market penetration in Central and Eastern Europe, the Balkans, and former Soviet states creates concentrated risk in regions of heightened geopolitical tension. Compromised routers can facilitate traffic interception, credential harvesting, and lateral movement into connected networks—capabilities valuable for both espionage and disruptive operations. The evidence of pre-patch exploitation raises concerns about the window of vulnerability between discovery by malicious actors and widespread patch deployment, particularly affecting organizations with limited security resources. For EU member states implementing NIS2 requirements, this incident underscores the criticality of network perimeter security and the challenge of securing widely distributed edge devices. The disclosure also highlights the strategic value of national CERT capabilities within NATO and EU cybersecurity frameworks, as Poland's CERT.PL demonstrated rapid technical analysis and coordinated disclosure practices. Globally, the vulnerability affects internet service providers, telecommunications operators, and critical infrastructure entities using MikroTik equipment, potentially enabling adversaries to establish persistent footholds in strategic networks across multiple continents.

Forecast

If exploitation continues before widespread patching occurs, affected RouterOS devices may be incorporated into botnet infrastructure or used as persistent access points for espionage operations. Organizations that delay patching—particularly in regions with lower cybersecurity maturity—are likely to face elevated risk of compromise. If the observed pre-patch exploitation is linked to state-sponsored actors, additional technical indicators and targeting patterns may emerge as threat intelligence firms conduct retrospective analysis. The incident may prompt regulatory discussions within the EU regarding mandatory security update mechanisms for network equipment and accelerated vulnerability disclosure timelines. If MikroTik's market share in critical infrastructure sectors becomes better documented, policymakers may consider supply chain diversification requirements similar to those applied to telecommunications equipment. In the near term, security researchers are likely to conduct further analysis of the patched RouterOS versions, potentially identifying additional vulnerabilities through differential analysis. If the identity or motivation of the pre-patch exploitation actors becomes clearer, this could inform attribution assessments and influence diplomatic or sanctions responses, particularly if links to ongoing conflict-related operations are established.