Internet-exposed MikroTik SSH just became a takeover story again. CERT.pl’s MikroTrick chain combines authentication bypass and privilege escalation so an unauthenticated attacker can take over RouterOS. Two of the CVEs are already on CISA’s KEV list.
If SSH, WebFig, or bandwidth-test is reachable from untrusted networks, patch and lock those services down before the weekend scans finish the job for you.
What happened
MikroTik published a September 2026 security update covering multiple RouterOS flaws reported with CERT.pl. The headline chain:
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
- CVE-2026-67276 — SSH authentication bypass (RSA public-modulus compare), CVSS ~9.2
- CVE-2026-86060 — SSH username argument injection that can elevate to full admin, CVSS ~9.2
- CVE-2026-67277 — bandwidth-test missing authentication enabling kernel memory disclosure / DoS, CVSS ~8.8
Fixed builds: 6.49.21 (long-term), 7.23.4, 7.24.2, and 7.25 beta 3. CISA added CVE-2026-67277 and CVE-2026-86060 to KEV on September 10, 2026 (federal due September 13). Exploitation of the SSH chain has been reported against devices with SSH exposed to the internet.
Why it matters
Edge routers with open management ports are botnet, pivot, and traffic-hijack candy. A full-admin RouterOS foothold means DNS, VPN, firewall rules, and upstream routes are attacker-editable.
RouterOS can mark compromised devices as Flagged in logs, but someone has to read them. If you patch without reviewing the config, attacker changes survive the upgrade.
What to do first
- Upgrade every RouterOS device to 6.49.21 / 7.23.4 / 7.24.2 (or newer). Confirm the version string after reboot.
- Until patched: disable or firewall SSH, WWW/WWW-SSL, and the bandwidth-test server to trusted management networks only (prefer WireGuard/VPN; do not expose management to the internet).
- After upgrade: check logs for Flagged status and review users, scripts, schedulers, and firewall rules for strangers.
- Rotate admin credentials and export a clean config baseline.
- Avoid initiating TLS/SSH from an unpatched device over untrusted networks (CERT.pl guidance).
Details
- Codename: MikroTrick (CERT.pl)
- CVEs: CVE-2026-67276, CVE-2026-86060, CVE-2026-67277 (plus related issues in the same disclosure set)
- Product: MikroTik RouterOS (v6 and v7 trains listed above)
- KEV: CVE-2026-67277 and CVE-2026-86060 added 2026-09-10
- Vendor bulletin: September 2026 vulnerability
Hunt / verify
- Confirm software version ≥ fixed builds on every device.
- Search logs for Flagged / compromise markers; run
/system/device-mode/printper vendor guidance. - Diff user list, scripts, and scheduler entries against last known-good export.
- Review WAN firewall for unexpected allow rules to TCP/22, WebFig, or btest.
Sources
- MikroTik: September 2026 vulnerability
- Help Net Security: RouterOS SSH flaws exploited (MikroTrick)
- Canadian Centre for Cyber Security AL26-020
- CISA KEV — CVE-2026-67277 / CVE-2026-86060
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
