Attackers are actively hijacking MikroTik routers by abusing critical flaws in the devices’ RouterOS Secure Shell (SSH) implementation, allowing them to gain full administrative control over internet-exposed systems without valid credentials, according to a new advisory from CERT Polska[1][3][6].
CERT Polska reports that it has identified and coordinated disclosure of six RouterOS vulnerabilities, including a chained exploit dubbed MikroTrick that targets routers whose SSH service is reachable from the public internet[1][2][6]. The issues have been assigned CVE identifiers ranging from CVE-2026-67276 through CVE-2026-67279, plus CVE-2026-67281 and CVE-2026-86060, all affecting MikroTik RouterOS software[7][8]. While the advisory confirms active exploitation in the wild, it does not specify how many devices have been compromised so far or which threat actors are behind the attacks[3][6].
The MikrohTrick chain relies on SSH-specific flaws that allow rogue logins and privilege escalation on vulnerable routers[1]. In one case, RouterOS fails to fully verify RSA public keys during SSH authentication, checking only the key type and modulus while omitting the exponent; an attacker who knows the modulus of an authorized key can craft a different key and authenticate as that user without possessing the corresponding private key[1][5]. CERT Polska also describes an issue in the SSH login mechanism that mishandles crafted usernames beginning with disallowed characters, enabling an attacker to elevate privileges once they have a foothold on the device[1].
According to CERT Polska, the vulnerabilities are already being leveraged to take over routers whose SSH service is exposed to the internet, with observed attacks dating back at least to September 2[3][6]. Once a router is compromised, attackers can obtain full administrative rights, modify configuration, pivot into internal networks, or conscript devices into botnets and proxy infrastructures[1][3]. The advisory notes that MikroTik has released patches that successfully block the attack chain, and urges operators to assume that any unpatched, internet-facing SSH service may have been targeted[1][3].
MikroTik has issued RouterOS updates addressing the flaws in versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, and CERT Polska says these releases prevent the attacks it has observed in the wild[1][2]. The team recommends immediate upgrading to one of the fixed versions and performing a thorough review of router configurations for signs of unauthorized changes or new user accounts that might indicate compromise[1][6].
Until patches can be deployed, defenders are advised to disable exposed management services or restrict access to trusted administration networks, with particular focus on SSH, WebFig’s HTTP/HTTPS interfaces, and the bandwidth-test server[1][2][3]. CERT Polska further warns against initiating TLS connections or using built-in SSH clients from unpatched devices, especially when traversing untrusted networks, to reduce the risk that vulnerable routers will be exploited during outbound management sessions[1][2].
References
- Critical vulnerabilities in MikroTik RouterOS are being …
- Krytyczne podatności w MikroTik RouterOS są aktywnie …
- Attackers Hijack MikroTik Routers Through Internet- …
- Vulnerabilities in Mikrotik RouterOS software
- Tag #routeros
- Autor CERT Polska
- Tag #vulnerability
