Affected Systems
MikroTik RouterOS versions prior to 6.49.21, 7.23.4, and 7.24.2. Affects devices with SSH service exposed to untrusted networks or the Internet. Default home configurations are not exposed, but custom firewall rules may create exposure.
Exploitation Status
Active exploitation confirmed since at least September 2, 2026 (one day before patches released). CISA added CVE-2026-86060 to KEV catalog on September 10. Attack artifacts observed in the wild include creation of 'ops' admin account and exfiltration of device configurations to attacker infrastructure at 82.192.72.4 and 103.102.31.18.
Business Impact
Attackers gain full administrative control of vulnerable MikroTik routers without credentials. This enables complete device takeover, configuration theft, persistent backdoor creation (unauthorized users, scripts, scheduler tasks), traffic interception, and use of compromised routers as pivot points into internal networks. The chain bypasses SSH authentication entirely by exploiting a state-machine flaw (CVE-2026-67279) and argument-injection vulnerability (CVE-2026-86060). Patching does not remediate pre-compromise artifacts; manual forensic review and potential device rebuild required.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update all MikroTik RouterOS devices to version 6.49.21, 7.23.4, 7.24.2 or later
- Run '/system/device-mode/print' on all devices to check Flagged status (note: absence does not guarantee device is clean)
- Search SSH logs for username '-2' and check user accounts for unauthorized 'ops' account or other unknown users with full privileges
- Review firewall rules, scheduler entries, scripts, tunnels, proxies, .rif diagnostic files, and fetch activity logs for anomalies
- If compromise indicators found: isolate device, preserve logs and configuration for forensics, factory reset, rebuild from trusted baseline, rotate all credentials including passwords and SSH keys, and do NOT restore backups from compromised devices