Critical MikroTik authentication-bypass and privilege escalation vulnerabilities allow external attackers to seize control of routers via exposed SSH ports, and active exploitation is already underway. The manufacturer chose to issue a vaguely worded security update, even as 122,500+ MikroTik routers sit with SSH exposed.

MikroTik shipped RouterOS fixes on September 3rd, 2026, with release notes that mention only an “important security update.” The company strongly recommends an update, but provides no technical details.

For the first time ever, MikroTik also sent users a push notification through its app to alert them about the update.

“To give time to update your systems, we are not currently publishing detailed information,” the security advisory reads.

However, security researchers have already reverse-engineered the patches using AI and identified 6 security bugs, including 2 critical ones.

Moreover, CERT Polska, Poland’s computer emergency response team, found evidence of active exploitation dating back to at least September 2nd. This means that attackers were exploiting the flaws as zero-days before a patch existed.

“Combining 2 of them allows an attacker to take full control of the device without authentication. We recommend applying the update immediately,” CERT Polska warns in an advisory.

The watchdog dubbed the exploit chain MikroTrick.

Over 122,500 MikroTik devices with accessible SSH have been found on the open internet by the Shadowserver Foundation, a non-profit security organization.

Most of the exposed devices are in Brazil (11,300), the US (7,100), Indonesia (7,100), the Czech Republic (6,300), and Ukraine (5,100), with thousands in other countries. It’s unclear how many of them remain vulnerable.

Assume compromise

Simply upgrading RouterOS is not enough – devices might already have been compromised. MikroTik’s advisory recommends taking additional steps after the upgrade – checking the “Log” section for “Flagged” status.

“RouterOS will check if your device has been compromised, and set it to ‘Flagged’ status if it is,” MikroTik’s advisory reads.

The owners of Flagged devices should treat the router as compromised. They are directed to follow another procedure.

Even when no Flagged state is found, the vendor recommends inspecting the device configuration for any unknown scripts, users, or ther suspicious configurations.

However, Nick Pratley, an independent security researcher who independently reverse-engineered the flaws, strongly recommends considering “a clean rebuild rather than trusting only automatic cleanup.”

What are the bugs?

CERT Polska took the initiative in registering six new CVEs for the discovered MikroTik RouterOS vulnerabilities:

• A critical SSH user impersonation vulnerability, CVE-2026-67276, has a severity score of 9.2 out of 10. It enables an attacker who knows an authorized user’s RSA modulus to forge a valid key and log in as that user without having the private key.
• A critical (9.2/10) SSH session privilege manipulation via a crafted username vulnerability, CVE-2026-86060. An unauthenticated attacker can exploit a malformed username to trick RouterOS's SSH login process into accepting forged data as proof of admin rights, leading to privilege escalation.
• A kernel memory disclosure and denial of service vulnerability CVE-2026-6727, rated 8.8 on the CVSS severity score. Unauthenticated attackers can leverage it by sending a specially crafted network request.
• High-severity (8.7/10) unauthenticated file-read vulnerability, CVE-2026-67281, affects RouterOS’s web-based management interface, WebFig. The vulnerable /jsproxy path lets an unauthenticated attacker manipulate memory allocation and use directory traversal to read files outside the intended web folder, including root-owned config files containing credentials.
• A TLS server impersonation bug, CVE-2026-67278, rated 6.3 out of 10, enables attackers to trick routers into trusting fake security certificates.
• SSH pre-authentication rekey state bypass vulnerability CVE-2026-67279 (6.9 out of 10): enables an unauthenticated attacker to send commands to a MikroTik router and potentially create, overwrite, and reconstruct files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.

CERT Polska confirmed that all these bugs were fixed in RouterOS versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).

According to Pritley’s independent report, RouterOS’s login process misinterprets a fake SSH username of literal “-2” and treats it as “read trusted fields from file descriptor 2.” Using this special username can trick the router into giving the session full administrator privileges.

What do we know about the attacks in the wild?

CERT Polska discovered successful cyberattacks originating from the IP addresses 82.192.72.4 and 103.102.31.18.

The observed attacks left the following markers in the RouterOS log:

login failure for user -2 from via ssh

user added by ssh:-2@

The attacker also created an “ops” account.

“The presence of any of these artifacts indicates an attempt to exploit the vulnerabilities and must be investigated immediately; at the same time, the absence of the traces mentioned above does not rule out unauthorized activity,” CERT Polska said.

Securityaffairs.com discovered users sharing logs of exploitation attempts on a Polish security forum.

The team discovered vulnerabilities using the GPT-5.5-cyber and GPT-5.6-sol models. Additional attackers are likely to quickly develop their working exploits.

“The patched RouterOS packages are already public, and their comparative analysis has allowed the community to reconstruct some of the fixed bugs. We limit the description to the information administrators need and do not publish exploit code or details that would make automating attacks easier,” CERT Polska’s advisory reads.