New MikroTik RouterOS Vulnerabilities Exploited by Hackers to Hijack Routers

Post Views: 14

Security researchers warn of active exploitation of critical vulnerabilities in MikroTik RouterOS, enabling unauthorized access and privilege escalation.

Overview of the Vulnerabilities

Hackers are exploiting a sequence of two recently disclosed vulnerabilities in MikroTik RouterOS to gain unauthorized access to routers with SSH services exposed to the internet. The first vulnerability, CVE-2026-67276, is an SSH authentication bypass flaw stemming from insufficient validation of RSA public keys. Attackers can exploit this by using a known username and the public modulus of the associated key to craft a malicious key, enabling login without the corresponding private key. The second vulnerability, CVE-2026-86060, is an SSH privilege escalation issue caused by improper handling of specially formatted usernames. This allows adversaries to manipulate SSH sessions to achieve administrative privileges. Both flaws were identified by Poland’s CERT agency in collaboration with GPT-5.5-cyber and GPT-5.6-sol, receiving critical severity ratings.

MikroTrick Exploit Chain

The exploit chain has been named MikroTrick, with the agency confirming active exploitation in real-world scenarios. Recent investigations reveal attacks targeting RouterOS devices accessible via public networks, with attackers utilizing the combined vulnerabilities to seize control of affected systems. A third flaw, CVE-2026-67277, impacts the RouterOS bandwidth-test service, enabling unauthenticated attackers to extract kernel memory or remotely crash routers.

Patches and Mitigation Measures

MikroTik addressed these issues in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, released on September 3. Poland’s CERT validated the patches, noting that not all configurations are affected but withholding specifics to allow users time to apply updates. The updates introduce a compromise-detection mechanism that checks for unauthorized configuration changes during startup, blocks malicious entries, and logs critical alerts. However, the CERT cautions that the absence of compromise markers does not guarantee a device is secure.

Indicators of Compromise

Indicators of compromise include log entries showing login failures for user -2 from specific IP addresses and the presence of a high-privilege ops account linked to confirmed attacks. Additional IoCs include the IP 82.192.72.4 and 103.102.31.18, which have been observed attempting to exploit MikroTrick.

Recommendations for Affected Users

If compromise is suspected, the agency advises isolating the device, preserving logs and configurations, performing a factory reset, and rebuilding from a trusted setup while rotating credentials and cryptographic keys. For users unable to apply updates immediately, restricting or disabling external access to SSH, WWW/WWW-SSL, and bandwidth-test services is recommended, along with avoiding built-in SSH clients and outbound TLS connections over untrusted networks.

Current Threat Landscape

As of September 5, The ShadowServer Foundation reported 122,500 MikroTik devices with exposed SSH interfaces, though the exact number of vulnerable devices remains undetermined. Once attackers obtain valid credentials, 37% of their actions are blocked. The Blue Report 2026 evaluates defensive measures across 338 million simulations conducted in customer environments.

“The exploit chain has been named MikroTrick, with the agency confirming active exploitation in real-world scenarios.”

Key Vulnerabilities

CVE-2026-67276: SSH authentication bypass due to insufficient RSA public key validation.
CVE-2026-86060: SSH privilege escalation via improper username handling.
CVE-2026-67277: Bandwidth-test service vulnerability enabling memory extraction or crashes.