7 SEP 2026 — CERT Polska has disclosed six vulnerabilities in MikroTik RouterOS and confirmed that two of them are being chained in the wild to take full control of internet-facing routers without any credentials. Exploitation was running from at least 2 September. The fixes landed on the 5th, which means the attacks came first.
The chain, and what it needs
The pair being exploited is called MikroTrick. CVE-2026-67276, at CVSS 9.2, is an SSH authentication bypass caused by improper public key verification. CVE-2026-86060, also 9.2, escalates privilege through a malformed SSH username.
Chained, they give an unauthenticated attacker full control of the device. The only precondition is that the SSH service is reachable from a public network, which on a router is a configuration choice rather than a defect.
A third disclosed flaw, CVE-2026-67277 at 8.8, leaks memory and can crash the device through the bandwidth-test service. Six were disclosed in total; three have been detailed.
Check for this before you patch
The indicators are specific and unusually easy to act on, which is the most useful part of the disclosure. Look for a highly privileged account named ops that nobody created, and for log entries recording a login failure for user -2.
That second one is the exploit's fingerprint. The malformed username used to trigger the privilege escalation appears in the log as a failure, so the sign of a successful attack is a record of one that appears to have failed.
Observed traffic came from 82.192.72.4, though a single address is a starting point for a log search rather than a boundary on the activity. Patching a device that is already compromised does not remove an account an attacker has created, so the order matters: look first, then update, then remove anything you find.
Edge devices, again
This is the same shape as most of the serious exploitation we have reported this year. The target is a network appliance, the flaw is in the management plane, the precondition is remote administrative access, and the attacker reaches administrative control without a credential.
MikroTik hardware occupies a particular position in that pattern. It is inexpensive, extremely capable, and consequently everywhere — small internet service providers, offices, homes, and a long tail of installations with no one responsible for patching them. The install base skews heavily toward devices that will never receive this advisory.
It also sits beside two other router disclosures inside a week. We covered Fire Ant operating on Cisco IOS XR and then Cisco disclosing seven previously unknown IOS XR flaws. Different vendors, different bugs, one category under sustained attention.
Why SSH is on the internet at all
The obvious question is why a router would accept SSH from anywhere, and the answer is operational rather than careless. These devices sit at sites with no technical staff — a small ISP's customer premises equipment, a branch office, a tower — and somebody has to be able to reach them without driving there.
The alternatives all cost something. Management over a VPN needs the VPN to survive whatever broke the router. Source address allow-lists need a stable address for the engineer, which mobile working does not provide. Out-of-band access needs a second connection per site, which is a line rental multiplied by the fleet.
Changing the port is not on that list. It reduces opportunistic scanning noise and does nothing against an attacker who scans all ports, which is every attacker with a scanner from this decade. It is the control that feels like security and does not survive contact with one.
The presence of a fix for RouterOS 6.49.21 alongside the version 7 branches says something about the fleet too. MikroTik is still patching a legacy branch, which it would not do unless a substantial number of production devices were still on it, and those are precisely the installations least likely to be updated this month.
The timeline is the uncomfortable part
Exploitation from 2 September, CISA adding the flaws to its Known Exploited Vulnerabilities catalogue on the 4th, and patched releases on the 5th. For three days there was active exploitation and no fix.
That ordering is not a failure by CERT Polska or MikroTik, and it is worth stating explicitly because it will be read as one. A coordinated disclosure that is overtaken by an attacker who found the same bug independently, or who reverse-engineered a pre-release fix, produces exactly this sequence.
What it does mean is that patch-day is not day zero for defenders. Any device that was exposed before 5 September needs to be examined for the indicators rather than merely updated, because an update is not evidence that nothing happened first.
What to do this week
Inventory RouterOS devices and identify which have SSH reachable from outside. Search logs for the -2 login failures and for unexpected privileged accounts. Update to 6.49.21, 7.23.4, 7.24.2 or 7.25beta3.
Then take management off the public internet, which is the control that would have made the whole chain unreachable. It is also the recommendation nobody follows, because remote administration is why the service was exposed in the first place and the trade is convenience against a rare event that has now happened.
The bounded claim: two chained flaws, unauthenticated full control, exploited before the fix existed, with a clean indicator of compromise available to anyone who reads their logs.
View author profile → · Editorial policy
