Back Isc.Sans.Edu

Critical MikroTik Vulnerability - Patch Now, (Sun, Sep 6th)

Isc.Sans.Edu • September 6, 2026

Mikrotik released a patch late last week for an already-exploited vulnerability. The vulnerability allows an SSH authentication bypass and is already being exploited. At this point, assume compromise. Attackers have been adding new accounts to affected devices to maintain access after a patch is installed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MikroTik RouterOS Vulnerabilities Under Active Exploitation CERT Polska has identified six critical vulnerabilities in MikroTik RouterOS, with two of them forming an attack chain named MikroTrick. This chain allows attackers to gain full administrative control of devices via SSH without authentication. The vulnerabilities, including CVE-2026-67276 and CVE-2026-86060, have been actively exploited since September 2, 2026. MikroTik has released patches in versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, but devices with exposed SSH services are considered compromised until proven otherwise. Security experts recommend immediate updates and thorough checks of device configurations for unauthorized changes. The attacks have been confirmed to originate from specific IP addresses, and the exploitation is ongoing. Administrators are urged to take immediate action to secure their devices. 17 sources 77

Critical MikroTik Vulnerability - Patch Now, (Sun, Sep 6th)

The full story

Extracted Entities

CWE Weaknesses (1)

MITRE ATT&CK (2)