Hackers Exploit MikroTik Vulnerabilities to Take Over MikroTik Routers Without Authentication

Attackers are actively exploiting a critical vulnerability chain dubbed MikroTrick to seize full administrative control of internet-exposed MikroTik RouterOS devices without valid credentials.

CERT Polska disclosed six RouterOS vulnerabilities on September 5, 2026, warning that two critical vulnerabilities could be chained to take over publicly reachable routers.

The Polish national CSIRT said it had confirmed real-world exploitation against devices with SSH accessible from the internet, while reports indicate attacks had been observed from at least September 2.

The exploit chain affects a device that often serves as the organization’s internet edge.

Once an attacker controls a router, they can alter traffic flows, create rogue administrative accounts, monitor or redirect traffic, deploy persistence, and potentially pivot into systems behind the network perimeter.

MikroTrick combines two defects across RouterOS’s SSH authentication and session-handling path.

Public reporting identifies the actively exploited chain as CVE-2026-67276, an SSH authentication-bypass issue, and CVE-2026-86060, a session privilege manipulation vulnerability caused by unsafe handling of specially crafted usernames.

Both vulnerabilities carry a CVSS severity score of 9.2.

The first stage allows an attacker to circumvent a normal SSH trust check and open an SSH command channel without possessing the target user’s private key.

The second stage abuses the RouterOS login process to manipulate the policy assigned to the session, effectively converting an unauthenticated or improperly authenticated SSH connection into a full-privilege administrative session.

Bishop Fox independently reproduced a related chain involving CVE-2026-67279 and CVE-2026-86060 on vulnerable RouterOS 7.x versions.

Its analysis found that SSH rekeying could advance an unauthenticated connection beyond the intended authorization boundary, after which a crafted username such as -2 could be interpreted as an instruction by a legacy login helper rather than as a normal user identity.

In the vulnerable flow, the helper could read a supposedly trusted identity record from an open file descriptor connected to the attacker’s terminal session.

Bishopfox Researchers said that, the attacks began before public disclosure and before patched releases were available, turning exposed SSH services into a high-priority entry point for network compromise.

That allowed the adversary to supply an administrator identity and policy mask, resulting in a privileged RouterOS session without completing conventional authentication.

MikroTik Vulnerabilities Exploited

The operational risk does not end once RouterOS is updated. Bishop Fox reported artifacts on internet-facing devices consistent with post-compromise persistence, including unauthorized full-privilege accounts, scripts, and scheduled tasks.

One observed technique used a scheduler entry to recreate a privileged account if defenders removed it periodically.

An unusual ownership value, owner=”0″, appeared on suspicious RouterOS scripts and schedulers.

Lab testing showed that objects created through the tested attack path could receive that numeric owner value, unlike objects created through a normal administrative login, which displayed owner=”admin”.

This is a hunting clue rather than proof of compromise, because legitimate service-created, imported, or historical objects may also have nonstandard ownership.

RouterOS logging can further complicate incident response. Login history is memory-resident by default and can disappear after a reboot.

In contrast, attacker-added accounts, scripts, schedulers, proxies, tunnels, and configuration changes may persist.

MikroTik has released fixes for the September vulnerability set and advises administrators to review its security notice.

CERT Polska also recommends immediate updates and configuration reviews because active exploitation is targeting publicly accessible RouterOS SSH services.

Organizations should update affected systems to RouterOS 6.49.21, 7.23.4, 7.24.2, or a later applicable release.

The updates block new exploitation but cannot remove attacker-created persistence or revoke access already obtained by an intruder.

Security teams should treat an exposed, unpatched MikroTik device as potentially compromised.

Before resetting a suspected router, collect its configuration, export available logs, inspect privileged accounts, review scripts and schedulers, identify unexpected proxies or tunnels, and examine configuration history and remote logging records.

Any suspicious system should be rebuilt from a verified baseline, with all passwords, SSH keys, VPN secrets, API credentials, and other secrets stored on or observable by the router rotated.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC