MikroTik RouterOS Vulnerabilities Under Active Exploitation

• •Two critical vulnerabilities in MikroTik RouterOS allow full device control via SSH.
• •Exploitation began on September 2, 2026, with confirmed attacks ongoing.
• •Immediate patching and configuration checks are essential for affected devices.

CERT Polska has identified six critical vulnerabilities in MikroTik RouterOS, with two of them forming an attack chain named MikroTrick. This chain allows attackers to gain full administrative control of devices via SSH without authentication. The vulnerabilities, including CVE-2026-67276 and CVE-2026-86060, have been actively exploited since September 2, 2026. MikroTik has released patches in versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, but devices with exposed SSH services are considered compromised until proven otherwise. Security experts recommend immediate updates and thorough checks of device configurations for unauthorized changes. The attacks have been confirmed to originate from specific IP addresses, and the exploitation is ongoing. Administrators are urged to take immediate action to secure their devices.