A router takeover that needs no password
Poland's national computer emergency response team, CERT Polska, has confirmed that attackers are actively hijacking MikroTik routers by chaining two flaws in the RouterOS operating system. The combination, which the team has named MikroTrick, lets an attacker with no valid credentials at all walk away with full administrative control of any device whose Secure Shell (SSH) service is reachable from the internet.
That is a meaningful distinction from most router attacks, which still need a leaked password, a default credential, or a stolen key. MikroTrick needs none of that.
How the two flaws fit together
The first flaw, tracked as CVE-2026-67276 and rated 9.2 out of 10 on the CVSS severity scale, sits in how RouterOS checks an SSH login attempt. Rather than verifying a client's entire RSA public key, the software only checks the key's type and its modulus, the large number at the core of an RSA key. An attacker who works out a legitimate user's modulus, which is not treated as secret in RSA, can present a forged key that RouterOS accepts as genuine.
The second flaw, CVE-2026-86060, also rated 9.2, is an argument-injection bug in how RouterOS parses usernames during the SSH login process. A username crafted with specific prohibited characters gets passed through in a way that lets an attacker manipulate the login command itself, rather than simply supplying a username.
Chained together, the two bugs let an attacker skip authentication entirely and land with full administrative rights. CERT Polska disclosed six RouterOS vulnerabilities in total on September 5, alongside MikroTik; the other four touch the bandwidth-test service, X.509 certificate handling, and the WebFig web interface, but it is this pair that forms the exploit chain under active use.
Attacks predate the patch
CERT Polska's logs show exploitation attempts going back to at least September 2, a day before MikroTik's fixes shipped. Confirmed activity has come from two IP addresses, 82.192.72.4 for successful compromises and 103.102.31.18 for attempts, though CERT Polska notes more may be involved. The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10.
According to scans run by the Shadowserver Foundation, roughly 122,500 MikroTik devices had SSH exposed to the open internet as of September 5. Shadowserver's count measures exposure, not confirmed compromise, and no authoritative figure for how many devices have actually been taken over has been published. MikroTik has said its default home configuration does not expose SSH to the internet, meaning most affected devices were reconfigured, by an administrator or an installer, to allow remote management.
What compromise looks like
CERT Polska has published specific signs to check for on any internet-facing MikroTik router:
- Log entries reading "login failure for user -2 from [ip] via ssh", which the attack chain produces even on a successful takeover
- A new, highly privileged account named "ops" that the administrator did not create
- A "Flagged" status marker that RouterOS itself sets at startup once it detects tampering, visible by running
/system/device-mode/print - Unrecognized users, scheduler tasks, scripts, or configuration changes
What to do
CERT Polska's guidance is direct. Update immediately to RouterOS 6.49.21, 7.23.4, or 7.24.2, whichever branch applies. If patching has to wait, disable SSH and the WebFig web interface, or restrict both to a trusted management network rather than the open internet. If a device already shows signs of compromise, do not simply patch and move on: isolate it, preserve logs and configuration for reference, perform a factory reset, and rebuild the configuration from a trusted backup rather than restoring one that predates the compromise, since a saved configuration could reintroduce whatever the attacker changed.
Why it matters
RouterOS runs on a huge base of small-business and internet service provider equipment precisely because it is cheap and remotely manageable, which is the same property MikroTrick abuses. A single unpatched, internet-facing router can hand an attacker a foothold inside a business network, a platform for further attacks against other targets, or both. Anyone who administers a MikroTik device, or has ever asked an installer to enable remote management on one, should treat this as urgent: check the RouterOS version, check the logs against CERT Polska's indicators, and patch before doing anything else with the device.
