MikroTrick: Exploited MikroTik RouterOS SSH Takeover Chain

What to do

1. Inventory every RouterOS device, including cloud and lab instances, and record its version.
2. Upgrade to 7.24.3, 7.23.6 or 6.49.21 or later; devices moved to 7.24.2 or 7.23.4 in September need a second upgrade.
3. Restrict SSH, WebFig (www/www-ssl) and the bandwidth-test server to trusted management addresses or disable them; prefer a VPN for management.
4. Run /system/device-mode/print and check the log for a critical 'Flagged' entry after upgrading.
5. Review users, scripts, scheduler entries, proxies and tunnels for anything you did not create, starting with a full-privilege user named 'ops'.
6. If you find signs of compromise, preserve logs and config, factory reset, rebuild from a trusted configuration and rotate every secret on the device.

How to check if you are affected or compromised

• Search RouterOS logs for 'login failure for user -2' and 'added by ssh:-2@' entries.
• Look for a full-privilege user named 'ops', and for scheduled scripts that recreate a privileged account.
• Check for SSH connections from 82.192.72.4 (successful attacks) and 103.102.31.18 (attempts), per CERT Polska.
• On fixed releases, check whether /system/device-mode/print reports the device as flagged.

What happened#

On September 3, 2026, MikroTik shipped RouterOS 7.24.2, 7.23.4 and 6.49.21 as "an important security update" and held back the details. The release notes mentioned only an SSH refactor and btest stability fixes. Two days later CERT Polska published the findings: six RouterOS bugs, two of which chain into what it calls MikroTrick. The chain gives full administrative control "without authentication" when SSH is reachable. CERT Polska says successful attacks began no later than September 2, a day before the patches.

Three of the six CVEs are in CISA's KEV catalog:

• CVE-2026-67279 (CVSS 4.0 6.9): after a client-requested rekey, RouterOS SSH enters the connection protocol even though no login was attempted. The client can then open a session channel and send an exec request. Added to KEV September 25.
• CVE-2026-86060 (CVSS 4.0 9.2): the SSH login helper accepts a username starting with a prohibited character. Bishop Fox explains that the username -2 makes the helper read its trusted identity from file descriptor 2, which the attacker controls. The helper then accepts a forged administrator record. Added to KEV September 10.
• CVE-2026-67277 (CVSS 4.0 8.8): the bandwidth-test (btest) service accepts a related connection before authentication. That leaks uninitialized kernel memory and can restart the router. Added to KEV September 10.

The other three, which are not in KEV, are an SSH public-key check that skips the RSA exponent (CVE-2026-67276), an unauthenticated WebFig file read on 7.20 and newer (CVE-2026-67281), and RSA signature forgery against TLS and SSH host keys (CVE-2026-67278). The September builds only partly fixed CVE-2026-67278. MikroTik's updated advisory names 7.24.3 and 7.23.6 as the complete fix.

Who is affected#

The KEV-listed bugs affect RouterOS 6.x before 6.49.21, 7.0 through 7.23.x before 7.23.4, and 7.24 before 7.24.2, according to CERT Polska's CVE list. Bishop Fox reproduced the full takeover on 7.x. On 6.49.20 the rekey bypass worked, but the chain did not produce an admin session. Patch 6.x anyway. CERT Polska's recommended minimums are 7.24.3 (stable), 7.23.6 (long-term) and 6.49.21.

Do you really need to act?#

If you own RouterOS devices, yes. The precondition is a reachable SSH service. MikroTik says its default configurations block management services from the internet, so the main targets are routers where someone opened SSH. That happens often on ISP, branch-office and hosted routers. The attack needs no credentials, CISA rates it automatable, and it worked before any patch existed. The Hacker News notes that no authoritative count of compromised devices has been published. Bishop Fox found compromise artifacts on internet-facing routers during authorized testing.

A router whose SSH is reachable only over a management VPN is not on the reported attack path. It still runs the vulnerable code, so upgrade it this week. The incomplete CVE-2026-67278 fix means devices upgraded in September need a second upgrade.

What to do now#

1. On each device, check the version with /system resource print.
2. Upgrade with /system package update check-for-updates then /system package update install, to 7.24.3, 7.23.6 or 6.49.21 or later.
3. Limit management services to trusted addresses, for example /ip service set ssh address=192.0.2.0/24, and do the same for www/www-ssl. Turn off the bandwidth-test server with /tool bandwidth-server set enabled=no if you do not use it. CERT Polska also advises against using /system ssh outbound from unpatched devices.
4. After upgrading, run /system/device-mode/print. Fixed releases scan for known traces of tampering at boot and set a "Flagged" marker. Do not clear it until you have investigated.
5. Review /user print, /system script print and /system scheduler print for anything you did not create.

How to tell if you were hit#

CERT Polska lists log lines such as login failure for user -2 from <ip> via ssh followed by user <name> added by ssh:-2@<ip>, a full-privilege user named ops, successful attacks from 82.192.72.4 and attempts from 103.102.31.18. Bishop Fox found a scheduled script that recreated a privileged account every day. It suggests objects with owner="0" as a hunting lead, with the caveat that legitimate objects can also show this. A missing indicator does not rule out compromise. If you find one, isolate the device, secure the logs and configuration, factory reset, and rebuild from a trusted configuration rather than a backup taken from the device. Then rotate every password, key and secret it held. Upgrading blocks new exploitation but does not remove existing access.

Timeline#

• Sep 2, 2026 — Earliest successful attacks seen by CERT Polska.
• Sep 3, 2026 — MikroTik releases 7.24.2, 7.23.4 and 6.49.21 with no vulnerability details.
• Sep 5, 2026 — CERT Polska publishes the six CVEs, the MikroTrick chain and indicators.
• Sep 10, 2026 — CISA adds CVE-2026-86060 and CVE-2026-67277 to KEV.
• Sep 17, 2026 — Bishop Fox publishes its analysis of the chain.
• Sep 25, 2026 — CISA adds CVE-2026-67279 to KEV (NVD).
• Oct 6, 2026 — MikroTik updates its advisory to list all six CVEs and names 7.24.3 and 7.23.6 as the complete fix.

Vulnerability records

• CVE-2026-86060 · KEV 2026-09-10 · RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted…
• CVE-2026-67279 · KEV 2026-09-25 · RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated…
• CVE-2026-67277 · KEV 2026-09-10 · RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. MikroTik — RouterOS September 2026 vulnerability advisory mikrotik.com
2. CERT Polska — Vulnerabilities in MikroTik RouterOS actively exploited cert.pl
3. CERT Polska — MikroTik RouterOS CVE entries cert.pl
4. CVE record — CVE-2026-86060 cve.org
5. CVE record — CVE-2026-67279 cve.org
6. CVE record — CVE-2026-67277 cve.org
7. NVD — CVE-2026-67279 nvd.nist.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2026-86060 cisa.gov
9. MikroTik forum — RouterOS 7.24.2 stable release notes forum.mikrotik.com
10. Bishop Fox — MikroTrick: inside the RouterOS takeover chain bishopfox.com

Coverage and analysis

1. The Hacker News — MikroTrick chain let attackers take over RouterOS thehackernews.com