# MikroTik Routers Are Being Hijacked With Zero Credentials

Page: https://hirantha.me/blog/mikrotik-routers-are-being-hijacked-with-zero-credentials
Published: 2026-09-25
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: mikrotik, routeros, ssh vulnerability, router security, cert polska

> A flaw chain called MikroTrick lets attackers take full control of internet-exposed MikroTik routers without a password, key, or finished login.

## A router takeover that needs no password

Poland's national computer emergency response team, CERT Polska, has confirmed that attackers are actively hijacking MikroTik routers by chaining two flaws in the RouterOS operating system. The combination, which the team has named MikroTrick, lets an attacker with no valid credentials at all walk away with full administrative control of any device whose Secure Shell (SSH) service is reachable from the internet.

That is a meaningful distinction from most router attacks, which still need a leaked password, a default credential, or a stolen key. MikroTrick needs none of that.

## How the two flaws fit together

The first flaw, tracked as CVE-2026-67276 and rated 9.2 out of 10 on the CVSS severity scale, sits in how RouterOS checks an SSH login attempt. Rather than verifying a client's entire RSA public key, the software only checks the key's type and its modulus, the large number at the core of an RSA key. An attacker who works out a legitimate user's modulus, which is not treated as secret in RSA, can present a forged key that RouterOS accepts as genuine.

The second flaw, CVE-2026-86060, also rated 9.2, is an argument-injection bug in how RouterOS parses usernames during the SSH login process. A username crafted with specific prohibited characters gets passed through in a way that lets an attacker manipulate the login command itself, rather than simply supplying a username.

Chained together, the two bugs let an attacker skip authentication entirely and land with full administrative rights. CERT Polska disclosed six RouterOS vulnerabilities in total on September 5, alongside MikroTik; the other four touch the bandwidth-test service, X.509 certificate handling, and the WebFig web interface, but it is this pair that forms the exploit chain under active use.

## Attacks predate the patch

CERT Polska's logs show exploitation attempts going back to at least September 2, a day before MikroTik's fixes shipped. Confirmed activity has come from two IP addresses, 82.192.72.4 for successful compromises and 103.102.31.18 for attempts, though CERT Polska notes more may be involved. The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10.

According to scans run by the Shadowserver Foundation, roughly 122,500 MikroTik devices had SSH exposed to the open internet as of September 5. Shadowserver's count measures exposure, not confirmed compromise, and no authoritative figure for how many devices have actually been taken over has been published. MikroTik has said its default home configuration does not expose SSH to the internet, meaning most affected devices were reconfigured, by an administrator or an installer, to allow remote management.

## What compromise looks like

CERT Polska has published specific signs to check for on any internet-facing MikroTik router:

- Log entries reading "login failure for user -2 from [ip] via ssh", which the attack chain produces even on a successful takeover
- A new, highly privileged account named "ops" that the administrator did not create
- A "Flagged" status marker that RouterOS itself sets at startup once it detects tampering, visible by running `/system/device-mode/print`
- Unrecognized users, scheduler tasks, scripts, or configuration changes

## What to do

CERT Polska's guidance is direct. Update immediately to RouterOS 6.49.21, 7.23.4, or 7.24.2, whichever branch applies. If patching has to wait, disable SSH and the WebFig web interface, or restrict both to a trusted management network rather than the open internet. If a device already shows signs of compromise, do not simply patch and move on: isolate it, preserve logs and configuration for reference, perform a factory reset, and rebuild the configuration from a trusted backup rather than restoring one that predates the compromise, since a saved configuration could reintroduce whatever the attacker changed.

## Why it matters

RouterOS runs on a huge base of small-business and internet service provider equipment precisely because it is cheap and remotely manageable, which is the same property MikroTrick abuses. A single unpatched, internet-facing router can hand an attacker a foothold inside a business network, a platform for further attacks against other targets, or both. Anyone who administers a MikroTik device, or has ever asked an installer to enable remote management on one, should treat this as urgent: check the RouterOS version, check the logs against CERT Polska's indicators, and patch before doing anything else with the device.

## Questions

**What is MikroTrick?**
It is CERT Polska's name for a chain of two RouterOS flaws, CVE-2026-67276 and CVE-2026-86060, that together let an attacker take full administrative control of a MikroTik router over SSH without any valid credentials.

**Which RouterOS versions are safe?**
MikroTik's fixed versions are 6.49.21, 7.23.4, and 7.24.2. Anything on an earlier release within an affected branch should be updated immediately.

**How do I check if my router has been compromised?**
Look for SSH login-failure log entries for a user named "-2", an unfamiliar administrative account named "ops", and a "Flagged" status from the `/system/device-mode/print` command, as documented by CERT Polska.

**Is my router at risk if I haven't enabled remote SSH access?**
MikroTik says its default home configuration does not expose SSH to the internet, so the immediate risk is concentrated on devices where an administrator or installer turned on remote SSH or WebFig management.

**What should I do if I can't patch right away?**
CERT Polska recommends disabling SSH and WebFig or restricting both to a trusted management network until the router can be updated to a fixed version.

## Sources

- [Critical vulnerabilities in MikroTik RouterOS are being actively exploited](https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/), CERT Polska
- [Vulnerabilities in Mikrotik RouterOS software](https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/), CERT Polska
- [MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key](https://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html), The Hacker News
- [Hackers exploit new MikroTik RouterOS flaws to hijack routers](https://www.bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/), BleepingComputer