Two SSH flaws hand attackers full control of MikroTik routers

On 5 September 2026 CERT Polska disclosed six vulnerabilities in MikroTik RouterOS, and warned at the same time that a critical chain of them is already being used against routers reachable from the internet. The chain has been named MikroTrick. It combines two flaws in the SSH service, CVE-2026-67276 and CVE-2026-86060, both scoring 9.2, to bypass authentication and ultimately take full administrative control of the router. CERT Polska has confirmed exploitation since at least 2 September, and says MikroTik's patched releases stop the observed attacks.

The advice is to update immediately to RouterOS 7.25beta3, 7.24.2, 7.23.4 or 6.49.21, and then inspect the device for unknown users, scripts, scheduled tasks, tunnels and other configuration changes that could indicate someone got there first.

What this means for you if you have MikroTik routers facing the internet

In our experience MikroTik gear tends to sit where the budget is small and the feature list long, in branch offices, at smaller service providers and in organisations that set it up themselves. That is exactly where SSH is often left open to the internet, because it was convenient on the day the device was configured. The chain needs no password. It only needs to reach the service. Full control of the router means control of the traffic behind it, the ability to set up tunnels out, and a foothold for moving further into the network.

The update is the first step, but it does not remove what the attacker has already left behind. A new user, a script that runs at boot, or a tunnel to an address you do not recognise all survive the upgrade. If the device has been exposed since 2 September, assume it may have had a visitor, and search accordingly. If you are unsure what has been added, a clean configuration from a known backup is safer than cleaning up.

Berigo recommends

• Update every MikroTik device to RouterOS 7.25beta3, 7.24.2, 7.23.4 or 6.49.21 without delay.
• Close SSH and other management services to the internet, and allow them only from known addresses or over VPN.
• Inspect each device for unknown users, scripts, scheduled tasks and tunnels, and compare against a known good configuration.
• If a device is suspected compromised, restore from a backup taken before 2 September, and rotate every password and key on it.
• Bring routers and firewalls into the vulnerability inventory, so the next advisory reaches the right person the same day.