MikroTik RouterOS Vulnerability: MikroTrick (CVE-2026-86060)

Summary

A critical MikroTik RouterOS vulnerability chain, dubbed "MikroTrick", is being actively exploited in the wild. On any RouterOS device that exposes SSH to the internet, an attacker can gain full administrator privileges without a password or SSH key. MikroTik routers sit at the network edge of countless businesses, campuses and service providers, so this is a direct business-continuity risk.

• What: Two chained flaws in the SSH login process allow unauthenticated, full-privilege access (MikroTrick).
• Critical CVEs: CVE-2026-86060 (CVSS v4 9.2), CVE-2026-67276 (CVSS v4 9.2), CVE-2026-67277 (CVSS v4 8.8).
• Status: Actively exploited. CISA added CVE-2026-86060 and CVE-2026-67277 to its KEV catalog on 10 September 2026.
• Fix: Upgrade to RouterOS 6.49.21, 7.23.4, 7.24.2 or 7.25 beta 3 and check for signs of compromise.

MikroTik RouterOS vulnerability: technical details

On 3 September 2026, MikroTik released fixed RouterOS builds on all release channels and described them as an "important security update". To give administrators time to patch, the vendor initially withheld technical details. On 5 September, Poland's national CERT (CERT Polska), which reported some of the flaws through coordinated disclosure, confirmed that attackers were chaining two of them to take over devices with SSH exposed to the internet.

According to the technical analysis CERT Polska published on 22 September, the chain works as follows:

• CVE-2026-67279: An SSH key re-exchange (rekey) triggered during authentication is mishandled, allowing the connection to reach the channel stage without a completed login.
• CVE-2026-86060: A specially crafted username beginning with a hyphen (e.g. "-2") lets the attacker control the privilege information passed to the login helper. The result: full administrator rights.

The same updates fix two further flaws. CVE-2026-67276 is a gap in RSA key verification that lets an attacker who knows a username and the modulus of that user's public key open an SSH session as that account. CVE-2026-67277 affects the unauthenticated bandwidth-test service and can cause a kernel memory leak or a device reboot.

Affected versions

The highest risk applies to devices with the SSH port reachable from the internet. MikroTik's default configuration blocks this port from the outside, but if it was opened manually for remote management, the device becomes a direct target. Shadowserver data cited by BleepingComputer showed roughly 122,500 MikroTik devices with an internet-reachable SSH interface as of 5 September.

Risk and potential impact

An attacker who controls an edge router can monitor traffic, change firewall and routing rules, open a path into the internal network or use the device as a staging point for further attacks. CERT Polska observed that successful intrusions created a full-privilege account named "ops", and that diagnostic files were exfiltrated from some devices.

One important detail: the earliest publicly known attack records date back to 2 September, one day before the patches were released. A device that is fully up to date today may therefore have been compromised before it was updated. Patching alone is not enough; a compromise assessment is essential.

Why you should not wait

CERT Polska notes that independent researchers diffed the update packages and publicly documented the core elements of the flaws within days of the release. Reproducing the attack is no longer limited to a small group. CISA also gave US federal agencies only three days to remediate CVE-2026-86060 and CVE-2026-67277, which clearly signals how serious the risk is considered.

Recommended actions

1. Build an inventory: Record the RouterOS version of every MikroTik device and whether SSH is reachable from outside.
2. Update: Move to at least 6.49.21, 7.23.4, 7.24.2 or 7.25 beta 3, depending on your channel. You can update via the "Check for updates" menu.
3. Lock down management services: Allow SSH only from trusted IP addresses or place management behind a VPN such as WireGuard. If you cannot update immediately, temporarily restrict SSH, WWW/WWW-SSL and the bandwidth-test service.
4. Check the "flagged" status: Fixed releases scan for known indicators of compromise at boot and write a critical entry to the log. Also check the flagged value in the output of /system/device-mode/print. No flag does not mean the device is clean.
5. Hunt for traces: Review users, scripts, scheduled tasks, proxy and tunnel settings. Known indicators: a "login failure for user -2" log entry, a privileged account named "ops", and the IP addresses 82.192.72.4 and 103.102.31.18.
6. If in doubt, run incident response: Isolate the device, preserve logs and configuration, reset it to factory defaults, rebuild it from a trusted configuration and rotate all passwords and keys. Do not blindly restore a full backup taken from a suspicious device.

How Doğa Network can help

Our team can support you with version and configuration audits of your MikroTik fleet, secure remote management (VPN) design, planned upgrades and compromise assessments. Call us on +90 850 888 3642 or email hi@doga.network.

Sources

• MikroTik – September 2026 vulnerability
• CERT Polska – Critical vulnerabilities in MikroTik RouterOS are being actively exploited
• CERT Polska – MikroTrick: technical analysis
• CISA – Adds two known exploited vulnerabilities to catalog (10 September 2026)
• NVD – CVE-2026-86060
• Canadian Centre for Cyber Security – AL26-020