Attackers are exploiting flaws in MikroTik RouterOS to take full control of routers whose SSH service can be reached from the internet. MikroTik published fixed versions on September 3, 2026, and CISA has since added three of the RouterOS flaws to its Known Exploited Vulnerabilities catalog. If a MikroTik router sits at the edge of your office network, or someone installed one for you and you are not sure how it is set up, update it and check it.
What happened
On September 3, 2026, MikroTik published what it called “an important security update” for RouterOS, the operating system on its routers. The advisory, which uses the name “MikroTrick”, lists CVE-2026-67276, CVE-2026-86060 and CVE-2026-67277, with fixes in RouterOS 6.49.21, 7.23.4, 7.24.2 and 7.25 beta 3. MikroTik credits CERT Polska with reporting the issues.
CERT Polska, which found the flaws and reported them to MikroTik, published an alert on September 5, 2026. It says it identified six RouterOS vulnerabilities, and that two of them combined let an attacker “take full control of the device without authentication” when SSH is reachable. CERT Polska has seen the attacks since at least September 2, 2026.
The six flaws in CERT Polska’s summary are:
- CVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH login to a user’s authorized key.
- CVE-2026-86060: an argument-handling flaw in the SSH login path, involving usernames that begin with a prohibited character, that allows privilege escalation. NVD rates it 9.8 (critical) under CVSS 3.1.
- CVE-2026-67279: RouterOS SSH moves into the connection stage after a client-requested rekey even though the user never authenticated.
- CVE-2026-67277: the bandwidth-test (btest) service accepts a related connection before the main session has finished authenticating. CERT Polska says this allows memory disclosure or denial of service.
- CVE-2026-67281: an unauthenticated file-read flaw in RouterOS WebFig, the web management interface, in the /jsproxy path.
- CVE-2026-67278: RouterOS accepts malformed RSA signatures across RSA-based services, including certificate validation and SSH host-key authentication.
CISA added CVE-2026-86060 and CVE-2026-67277 to its catalog on September 10, 2026, with a due date of September 13, 2026. It added CVE-2026-67279 on September 25, 2026, with a due date of September 28, 2026, noting that it can be chained to achieve unauthenticated exploitation of CVE-2026-86060. In plain terms: an attacker who can reach the router’s SSH port does not need a password.
Who is affected
According to CERT Polska’s summary, CVE-2026-86060, CVE-2026-67279 and CVE-2026-67277 affect RouterOS 6.0.0 up to (not including) 6.49.21, 7.0.0 up to 7.23.4, and 7.24 up to 7.24.2. CVE-2026-67276 affects 7.9 up to 7.23.4 and 7.24 up to 7.24.2. CVE-2026-67281 affects 7.20 up to 7.23.4 and 7.24 up to 7.24.2. The NVD API lists the same ranges for CVE-2026-86060 and CVE-2026-67279.
Exposure matters as much as version. MikroTik’s advisory says “most configurations are not at risk,” and it recommends restricting SSH to trusted networks. CERT Polska names three services to disable or block from untrusted networks: SSH, web management (WWW/WWW-SSL) and the bandwidth-test server. Each one is home to at least one of these flaws. They often end up exposed without anyone deciding it: a port opened years ago for remote support, a setting carried over from a previous installer, or a router set up by someone no longer around.
One more detail matters for the update you choose. CERT Polska’s summary says CVE-2026-67278 affects 7.0.0 up to 7.23.6 and 7.24 up to 7.24.3, so on the version 7 line the fully fixed releases are 7.23.6 and 7.24.3, one step past the versions in MikroTik’s original advisory.
What to do
This is a short job for whoever manages your router, and you can forward the list as written.
- Find every MikroTik device you own. Include the main office router, branch or warehouse routers, and any device a contractor or internet provider installed. Note the RouterOS version running on each.
- Check whether SSH, web management (WWW/WWW-SSL) or the bandwidth-test server is reachable from the internet. If any of the three is open, disable it or block it from all addresses outside your trusted management network. MikroTik recommends restricting SSH to trusted networks, and CERT Polska gives the same advice for all three services until the update is installed.
- Update RouterOS now. CERT Polska’s advice is to update immediately. On the version 6 line, install 6.49.21. On version 7, install 7.23.6 or 7.24.3, which CERT Polska lists as covering all six flaws above, including CVE-2026-67278.
- Look for signs the router was already taken over. MikroTik says RouterOS checks whether a device has been compromised and sets it to “Flagged” status if it has; after upgrading, look in the log for that entry. CERT Polska says to check the flagged marker with the /system/device-mode/print command. Other indicators it lists: log entries reading “login failure for user -2” via SSH, and a highly privileged user account named “ops”. It also names two source addresses seen in the attacks, 82.192.72.4 and 103.102.31.18, which are worth searching for in your logs.
- Review the configuration after updating. MikroTik advises checking for scripts, user accounts or settings you do not recognize, even on a device that is not flagged. CERT Polska adds scheduler tasks, proxy servers and tunnels to that list. Remove anything nobody on your side can account for.
- If you find signs of compromise, do not just patch and move on. CERT Polska says to isolate the device, save its logs and configuration before a factory reset, rebuild it from a trusted configuration, and change all passwords and keys.
- Change how you reach the router remotely. MikroTik recommends using a VPN such as WireGuard for remote management rather than exposing management ports. Make that the standing rule, not a one-time fix.
What can wait
The update itself should not wait. CERT Polska says to update immediately, and closing the exposed services is a stopgap, not a substitute. Even a router with all three services closed should get a fixed release as soon as someone can reach it.
Some things can follow. You do not need to replace the hardware: these are software flaws with published fixes. You do not need to act on other brands of router because of this advisory; it applies to RouterOS only. And a full review of everything your firewall exposes to the internet is worth doing, but it can come after the MikroTik devices are updated and checked.
When to get help
Bring in help if you cannot tell who set up the router, if nobody has the admin password, if you are not sure whether SSH, web management or the bandwidth-test server is reachable from outside, if the device shows the flagged marker or an “ops” user, or if it also runs your VPN and you cannot afford a mistake during the update. A compromised edge router can see and redirect everything that passes through it, so a careful rebuild is worth more than a fast one. Our network services team works on small office routers and firewalls, and our cybersecurity reviews cover what your network exposes to the internet.
If you would like our engineers to check your MikroTik routers, update them and confirm nothing was left behind, contact Summit Networks.