MikroTik’s latest RouterOS security update has taken on a new urgency. What initially appeared to be an important but largely precautionary update has now been linked to active attacks against internet-accessible devices, according to CERT Polska. The vulnerabilities, tracked collectively as “MikroTrick,” can allow attackers to bypass SSH authentication and escalate privileges to full administrative control on vulnerable routers.
MikroTik has released security updates for RouterOS after researchers uncovered multiple vulnerabilities that can expose routers to serious attacks. What initially appeared to be a precautionary security update has now become an urgent incident: CERT Polska says attackers are actively exploiting vulnerable RouterOS devices whose SSH services are accessible from the public internet.
The vulnerabilities, collectively referred to by researchers as “MikroTrick,” affect RouterOS across several major release branches. CERT Polska says that combining two of the flaws can allow an attacker to bypass authentication and gain full administrative control of an affected router without knowing the legitimate user’s password or private SSH key.
For organizations relying on MikroTik routers for internet connectivity, remote access, branch networking or internal infrastructure, this is no longer simply a routine patching exercise. It is a security incident that deserves immediate attention.
MikroTik released the security bulletin on September 3, initially warning customers that an important RouterOS vulnerability had been identified and that fixed releases were available. The company deliberately held back detailed technical information to give customers time to patch their systems.
Two days later, CERT Polska published technical details and confirmed that exploitation was already taking place.
The fixed versions are:
• RouterOS 7.25 beta 3
• RouterOS 7.24.2
• RouterOS 7.23.4
• RouterOS 6.49.21
Organizations should move to the appropriate fixed release for their deployment as quickly as possible.
WHAT IS “MIKROTRICK”?
“MikroTrick” is the name CERT Polska has given to an attack chain involving vulnerabilities in MikroTik RouterOS.
CERT Polska says its research identified six vulnerabilities affecting different RouterOS components, including the SSH server and client, the bandwidth-test service, X.509 certificate handling and the WebFig interface. Three of the most significant flaws publicly described include CVE-2026-67276, CVE-2026-86060 and CVE-2026-67277.
CVE-2026-67276 is an SSH authentication bypass vulnerability rated CVSS 9.2. According to CERT Polska, RouterOS did not properly verify the complete RSA public key during authentication. Under specific circumstances, an attacker who knew information associated with an authorized key could construct a different key and authenticate without possessing the corresponding private key.
CVE-2026-86060, also rated CVSS 9.2, involves the handling of specially crafted usernames during SSH authentication. CERT Polska says successful exploitation could result in a session with full administrative privileges.
Another flaw, CVE-2026-67277, affects the bandwidth-test service and carries a CVSS score of 8.8. It can enable memory disclosure or a remote denial-of-service condition under certain circumstances.
The most serious concern is what happens when vulnerabilities are chained together.
According to CERT Polska, attackers have been using the combination to take complete control of RouterOS devices where SSH is exposed to public networks. The organization says the attacks have been observed in the wild and that the released patches prevent the observed attack chain.
WHY SSH EXPOSURE MATTERS
SSH is widely used by network administrators to remotely manage infrastructure. The problem arises when management interfaces are exposed directly to the internet.
MikroTik’s default configuration generally blocks SSH access from the internet. However, organizations and administrators sometimes open management ports to facilitate remote administration.
That configuration can dramatically increase the attack surface.
If a vulnerable MikroTik router has SSH exposed to an untrusted network, an attacker may be able to target the device remotely rather than first compromising another system inside the organization.
For enterprises, this matters because a router is not simply another endpoint. It sits at a critical control point in the network.
A compromised router can potentially become a foothold for further intrusion, a platform for traffic interception or manipulation, a pivot point into internal networks, or an additional infrastructure asset controlled by an attacker.
That makes the MikroTik disclosure particularly important for organizations operating distributed branches, data centers, telecommunications infrastructure, managed networks and remote offices.
THE MOST IMPORTANT WARNING: A PATCHED DEVICE MAY STILL HAVE BEEN COMPROMISED
One of the most important details in the CERT Polska disclosure is that installing the update is necessary, but it should not automatically end the investigation.
MikroTik has added a mechanism that can identify certain known signs of unauthorized modification. When RouterOS detects relevant indicators, the device can be marked as “Flagged” and record a critical message in its logs.
But administrators should not interpret the absence of the Flagged status as proof that a device has never been compromised.
CERT Polska explicitly warns that the mechanism only detects selected traces of compromise.
In other words, “not Flagged” does not necessarily mean “safe.”
Security teams should therefore patch first, then inspect the device’s configuration and logs for suspicious changes.
Look particularly for:
• Unknown administrator accounts
• Unexpected scripts
• Suspicious scheduled tasks
• Unrecognized configuration changes
• Unexpected proxy settings
• Unknown tunnels
• Unusual SSH activity
• Unexpected authentication failures
• Other services that have been enabled without authorization
WHAT ATTACKERS COULD DO WITH A COMPROMISED ROUTER
A router compromise can have consequences well beyond the device itself.
The exact impact depends on how the router is deployed and what network privileges it has, but a successful compromise could give attackers control over a critical piece of network infrastructure.
For businesses, that can mean disruption to connectivity, unauthorized changes to network traffic, potential access to internal systems and increased difficulty detecting subsequent activity.
For internet service providers, hosting companies, telecommunications operators and large enterprises, the stakes can be even higher because a compromised router may sit at a strategic point in a much larger infrastructure.
This is why network infrastructure should be treated as part of the organization’s cybersecurity perimeter, not as an isolated IT asset.
Organizations looking to strengthen their broader cybersecurity posture should also include network devices in vulnerability management, asset inventories, security monitoring and incident-response exercises.
10 ACTIONS SECURITY TEAMS SHOULD TAKE NOW
- Patch every affected RouterOS device
Identify all MikroTik devices running RouterOS across the organization and upgrade them to a fixed release.
The patched versions identified by MikroTik are 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21.
Do not assume that a router is safe simply because it has not caused an obvious problem.
- Check whether SSH is exposed to the internet
Review firewall rules and management access policies.
If SSH is accessible from untrusted networks, remove that exposure immediately.
MikroTik recommends restricting SSH access to trusted IP addresses or, preferably, using a VPN such as WireGuard instead of exposing management services directly to the internet.
- Restrict all router management interfaces
SSH is not the only service that deserves attention.
Review WebFig, WWW/HTTPS management access, bandwidth-test and other remotely accessible services. Disable anything that is not required.
CERT Polska specifically recommends restricting exposed services when immediate patching is not possible.
- Review the RouterOS logs
Search for unusual authentication failures, unexpected administrative activity and other indicators of compromise.
CERT Polska identified suspicious SSH activity in observed attacks and recommends checking the logs after upgrading.
- Check the “Flagged” status
Inspect the RouterOS logs and device status for evidence that the device has been marked as compromised.
If the device is Flagged, treat that as a serious incident rather than simply clearing the warning.
- Audit users, scripts and scheduled tasks
Compare the current configuration against a known-good baseline.
Look for accounts, scripts, scheduler entries, tunnels, proxies or other configuration elements that administrators cannot explain.
An unfamiliar privileged account should be treated as a potential indicator of compromise.
- Preserve evidence before resetting a compromised router
If a device appears compromised, do not immediately wipe it and move on.
Preserve relevant logs and configuration information first so that security teams can investigate what happened.
CERT Polska recommends securing logs and configuration before performing a factory reset.
- Rotate credentials and secrets after compromise
If compromise is confirmed or strongly suspected, change administrator passwords and other credentials associated with the affected infrastructure.
Review SSH keys and other secrets that may have been accessible from the compromised device.
- Rebuild compromised devices from a trusted configuration
CERT Polska recommends restoring compromised devices to factory settings and rebuilding them using a trusted configuration.
Do not blindly restore a complete backup created from a potentially compromised router.
- Add network devices to your vulnerability-management program
The MikroTik incident is another reminder that routers, firewalls, switches and other network infrastructure need the same security attention as servers and endpoints.
Maintain an accurate inventory, monitor firmware versions, establish patching deadlines and continuously review internet-facing management services.
For organizations that need to strengthen staff capabilities, cybersecurity training and security awareness should also cover network-device security, vulnerability management and incident response. Training and professional cybersecurity development resources are available through Saintynet Cybersecurity.
WHY THIS MATTERS TO ORGANIZATIONS IN THE MIDDLE EAST AND AFRICA
MikroTik equipment is widely used across businesses, service providers, enterprises, educational institutions, government environments and smaller organizations around the world.
That makes this vulnerability relevant to the Middle East and Africa, where network infrastructure often supports geographically distributed offices, branch connectivity, wireless deployments and remote administration.
The biggest risk is not necessarily sophisticated exploitation inside a highly protected corporate environment. It can be much simpler: an internet-facing management service that was opened years ago and forgotten.
For organizations operating critical infrastructure or public-facing services, this is a useful reminder that perimeter security cannot be treated as a one-time configuration exercise.
Security teams should know exactly which network devices are exposed, which management services are reachable from outside, who can administer them and whether their software is current.
A router that has been quietly sitting in a server room for years can still become an entry point for a modern attack.
THE BIGGER LESSON FOR SECURITY TEAMS
The MikroTik case highlights an uncomfortable reality of modern cybersecurity: attackers do not always need to begin with a laptop, server or employee account.
They can start with the infrastructure that connects everything together.
Network devices are attractive targets because they often operate continuously, sit at strategic points in the network and receive less security monitoring than traditional endpoints.
The situation also illustrates why vulnerability disclosure timelines matter.
MikroTik initially withheld technical details to give customers time to patch. That window was short. CERT Polska subsequently confirmed active exploitation and published additional technical information once the fixes were available.
For defenders, the lesson is straightforward: when a vendor describes a vulnerability as important and releases an emergency or out-of-band security update, organizations should not wait for proof of exploitation before acting.
By the time exploitation becomes public, attackers may already be testing the internet for vulnerable systems.
CONCLUSION
The MikroTik RouterOS issue has moved rapidly from a vendor security advisory to an actively exploited vulnerability.
MikroTik has released fixes across several RouterOS branches, while CERT Polska has confirmed real-world attacks against devices with publicly accessible SSH services. The vulnerabilities can be chained to bypass authentication and take full control of affected routers.
The immediate priority is therefore clear: identify vulnerable MikroTik devices, install the appropriate RouterOS update, remove unnecessary internet exposure and investigate the device for signs of compromise.
Most importantly, organizations should not stop at patching.
A secure router is not simply a router running the latest software. It is a device with restricted management access, known configurations, monitored logs, controlled administrative accounts and a clear place within the organization’s wider cybersecurity strategy.
For network administrators, the message from this incident is simple: patch the router, close the exposed management ports, inspect what changed and do it now.
