MikroTik RouterOS MikroTrick: Unauth SSH Chain Hijacks Devices

Internet-exposed MikroTik SSH just became a takeover story again. CERT.pl’s MikroTrick chain combines authentication bypass and privilege escalation so an unauthenticated attacker can take over RouterOS. Two of the CVEs are already on CISA’s KEV list.

If SSH, WebFig, or bandwidth-test is reachable from untrusted networks, patch and lock those services down before the weekend scans finish the job for you.

What happened

MikroTik published a September 2026 security update covering multiple RouterOS flaws reported with CERT.pl. The headline chain:

• CVE-2026-67276 — SSH authentication bypass (RSA public-modulus compare), CVSS ~9.2
• CVE-2026-86060 — SSH username argument injection that can elevate to full admin, CVSS ~9.2
• CVE-2026-67277 — bandwidth-test missing authentication enabling kernel memory disclosure / DoS, CVSS ~8.8

Fixed builds: 6.49.21 (long-term), 7.23.4, 7.24.2, and 7.25 beta 3. CISA added CVE-2026-67277 and CVE-2026-86060 to KEV on September 10, 2026 (federal due September 13). Exploitation of the SSH chain has been reported against devices with SSH exposed to the internet.

Why it matters

Edge routers with open management ports are botnet, pivot, and traffic-hijack candy. A full-admin RouterOS foothold means DNS, VPN, firewall rules, and upstream routes are attacker-editable.

RouterOS can mark compromised devices as Flagged in logs, but someone has to read them. If you patch without reviewing the config, attacker changes survive the upgrade.

What to do first

• Upgrade every RouterOS device to 6.49.21 / 7.23.4 / 7.24.2 (or newer). Confirm the version string after reboot.
• Until patched: disable or firewall SSH, WWW/WWW-SSL, and the bandwidth-test server to trusted management networks only (prefer WireGuard/VPN; do not expose management to the internet).
• After upgrade: check logs for Flagged status and review users, scripts, schedulers, and firewall rules for strangers.
• Rotate admin credentials and export a clean config baseline.
• Avoid initiating TLS/SSH from an unpatched device over untrusted networks (CERT.pl guidance).

Details

• Codename: MikroTrick (CERT.pl)
• CVEs: CVE-2026-67276, CVE-2026-86060, CVE-2026-67277 (plus related issues in the same disclosure set)
• Product: MikroTik RouterOS (v6 and v7 trains listed above)
• KEV: CVE-2026-67277 and CVE-2026-86060 added 2026-09-10
• Vendor bulletin: September 2026 vulnerability

Hunt / verify

• Confirm software version ≥ fixed builds on every device.
• Search logs for Flagged / compromise markers; run /system/device-mode/print per vendor guidance.
• Diff user list, scripts, and scheduler entries against last known-good export.
• Review WAN firewall for unexpected allow rules to TCP/22, WebFig, or btest.

Sources

• MikroTik: September 2026 vulnerability
• Help Net Security: RouterOS SSH flaws exploited (MikroTrick)
• Canadian Centre for Cyber Security AL26-020
• CISA KEV — CVE-2026-67277 / CVE-2026-86060

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].