“In recent days we have been observing attacks against RouterOS devices accessible from the internet,” Poland's CERT warned, describing an active campaign that the agency has dubbed “MikroTrick.”
Poland's CERT, GPT assistance, and the MikroTrick label
Poland's Computer Emergency Response Team discovered and disclosed a chain of vulnerabilities in MikroTik RouterOS that it says is already being exploited in the wild. The agency credited its discovery to work that included assistance from two large-language models, GPT-5.5-cyber and GPT-5.6-sol, and gave the combined attack a critical severity rating. Poland's CERT explicitly confirmed active exploitation and gave the chain the name “MikroTrick.”
CVE-2026-67276 and CVE-2026-86060: the two-step takeover
The MikroTrick chain relies on two distinct SSH defects in RouterOS. CVE-2026-67276 is an SSH authentication bypass caused by incomplete validation of RSA public keys: an attacker who already knows a username and the public modulus of that user’s key can craft a different key and authenticate without the legitimate private key. CVE-2026-86060 is an SSH privilege-escalation flaw arising from improper handling of specially crafted usernames; attackers can manipulate the SSH session using a crafted username to obtain full administrative privileges. Together, the authentication bypass plus privilege escalation lets attackers take full control of devices whose SSH services are exposed to public networks, the CERT said.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCVE-2026-67277: bandwidth-test memory leak and crash risk
Poland's CERT also highlighted a third issue, CVE-2026-67277, affecting RouterOS’s bandwidth-test service. That flaw allows unauthenticated attackers to leak kernel memory or to remotely crash or restart the router—additional risks that expand the impact beyond SSH access.
MikroTik patches, detection additions, and vendor disclosure choices
MikroTik released fixes in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21 on September 3; Poland's CERT validated the fixes. The vendor noted that not all configurations are affected but declined to disclose further technical details in its advisory, saying it intended to give users time to apply updates. The updates also add a compromise-detection mechanism that searches for known signs of unauthorized configuration changes during startup, disables malicious entries, and logs a critical warning when indicators are found. Poland's CERT cautioned, however, that the absence of a detection marker should not be taken as proof that a router has not been compromised.
Indicators of compromise and recommended response
The CERT published concrete indicators of compromise (IoCs) and a stepped response for administrators who suspect an intrusion:
- Log entries: “login failure for user -2 from <ip> via ssh” and “user <name> added by ssh:-2@<ip>”
- Presence of a highly privileged ops account
- IP addresses associated with activity: 82.192.72.4 (linked to confirmed successful attacks) and 103.102.31.18 (observed attempting to exploit MikroTrick)
If compromise is suspected, the CERT recommends isolating the router, preserving logs and configuration for analysis, factory-resetting the device, and rebuilding it from a trusted configuration while rotating passwords, keys, and other secrets. For administrators unable to apply updates immediately, the CERT suggests restricting or disabling externally accessible SSH, WWW/WWW-SSL, and bandwidth-test services, and avoiding the built-in SSH clients and outbound TLS connections over untrusted networks.
What this means for network operators, enterprises, and security teams
- Network operators and small-system administrators: count and isolate RouterOS devices with publicly accessible SSH. The ShadowServer Foundation reported 122,500 MikroTik devices with an exposed SSH interface as of September 5; Poland’s CERT emphasized that the exact number vulnerable to MikroTrick was not determined.
- Enterprises and procurement leaders: prioritize applying the September 3 RouterOS updates and validate detection markers on devices after patching. MikroTik’s updates add startup checks, but the CERT warned such markers are not a guarantee against prior compromise.
- Security teams and incident responders: preserve logs and configurations if compromise is suspected and follow the CERT’s recommended rebuild-and-rotate workflow to remove persistent access and replace secrets.
There is a practical, narrow urgency to these facts: an authentication bypass and a username-based privilege escalation chained against internet-exposed SSH services, confirmed active exploitation, published IoCs, and more than a hundred thousand devices with SSH reachable from the internet. The vendor issued fixes and added detection logic, but Poland's CERT and the published IoCs make clear that discovery, containment, and a careful rebuilding of affected devices remain necessary steps for operators who cannot immediately patch.
