Reported by 18 outlets
Three CVEs on MikroTik RouterOS — equipment massively deployed across ISPs, enterprises, and embedded networks
Why this score
- Breadth
- 2.00 / 2.0 · 18 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 4.60 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.19 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Desk analysis
MikroTik shipped emergency RouterOS builds 6.49.21, 7.23.4, 7.24.2, and 7.25 beta 3 on September 3, 2026 to fix six vulnerabilities, and CERT Polska disclosed the next day that attackers were actively chaining two of them, a combo named MikroTrick, to take full administrative control of devices whose SSH service is reachable from the public internet. Forum attack logs date to September 2, before the patches existed, and Bishop Fox later reproduced the chain and found exploitation artifacts on real devices consistent with pre-patch attacks.
The chain pairs CVE-2026-67279, an SSH rekey state-machine flaw that lets an unauthenticated client push the connection into a post-authentication state, with CVE-2026-86060, an argument injection (CWE-88) in /nova/bin/login scored CVSS 9.2 that manipulates the trusted RouterOS policy mask into full privilege escalation. CERT Polska's technical analysis separates CVE-2026-67276, a distinct RSA public-key forgery authentication bypass that early coverage conflated with the chain, and lists CVE-2026-67277 (CVSS 8.8), a bandwidth-test memory disclosure and denial-of-service flaw, among the six. CERT Polska's research used the LLM agents GPT-5.5-cyber and GPT-5.6-sol.
Exploitation is confirmed and ongoing, not historical. CISA put CVE-2026-67277 and CVE-2026-86060 on KEV September 10 with a September 13 remediation deadline, CVE-2026-67279 followed onto the catalog, and coverage the week of September 26 confirms the complete MikroTrick chain is KEV-listed as granting unauthenticated full admin access to exposed routers. The Hacker News reported again on September 26 that the RouterOS flaws are still being actively exploited in the wild, alongside the separately tracked SharePoint RCE. Canada's Cyber Centre tracked the same set in advisories AV26-887 and AV26-958. Published indicators include the domains mythtime.xyz, leappoach.info, and eeongous.com, an ops account in the full-privilege group, failed SSH logins for the user "-2", scheduler entries pairing fetch with import, unexpected socks proxy enablement, and the IPs 82.192.72.4 and 103.102.31.18. Run 6.49.21 on any 6.x device, check the Flagged status MikroTik writes when compromise indicators are found after upgrade, hunt for unknown scripts, users, and scheduler jobs, and keep Winbox, WebFig, and SSH off the internet.
Timeline
-
original reporting
Three CVEs on MikroTik RouterOS — equipment massively deployed across ISPs, enterprises, and embedded networks
malware.news · 33d ago · September 10th, 2026
Three CVEs on MikroTik RouterOS — equipment massively deployed across ISPs, enterprises, and embedded networks. MikroTik is regularly targeted by threat actors. Three vulnerabilities tracked as CVE-2026-67276, CVE-2026-67277, and CVE-2026-86060 affect RouterOS. CISA added CVE-2026-67277 and CVE-2026-86060 to the Known Exploited Vulnerabilities catalog on September 10. Organizations should update RouterOS immediately and check for indicators of compromise.
via Mastodon https://malware.news/t/al26-020-vulnerabilities-impacting-mikrotik-routeros-cve-2026-67276-cve-2026-67277-and-cve-2026-86060/125517
-
update from mikrotik.com
MikroTik Security: September 2026 vulnerability
mikrotik.com · 41d ago · September 3rd, 2026
MikroTik's September 3, 2026 bulletin ships fixes for the RouterOS vulnerabilities CERT.pl codenamed MikroTrick, naming CVE-2026-67276, CVE-2026-86060 and CVE-2026-67277, in releases 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. The vendor instructs administrators to keep SSH closed to untrusted networks, prefer WireGuard for management access, and check the new Flagged status mechanism that scans startup configuration for signs of compromise. RouterOS devices showing Flagged status should be treated as taken over.
-
update from npratley.net
Reversing MikroTik's Silent Patch: The RouterOS 7.23.4 Fix They Wouldn't Explain
npratley.net · 40d ago · September 4th, 2026
Independent diff of RouterOS 7.23.3 against 7.23.4 packages, published on 4 September 2026 (CERT Polska records the article at 03:22 UTC), a day before CERT Polska's advisory. It identified the new validLoginParamInput validator guarding /nova/bin/login against the "-2" file-descriptor argument injection, demonstrated an end-to-end SSH authentication bypass by forging rsa-sha2-256 signatures for an account bound to a known RSA e=3 key, and reproduced controlled code execution in nova/bin/mtget through an oversized TFTP fetch pathname with a working ROP call. It also listed campaign indicators beyond the vendor text: scheduler entries pairing fetch with import, the domains mythtime.xyz, leappoach.info, and eeongous.com, unexpected /ip socks enablement, and an ops user in the full group.
-
update from forum.mikrotik.com
Important security update
forum.mikrotik.com · 39d ago · September 4th, 2026
MikroTik's forum announcement of the emergency RouterOS release (fix in 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21 and newer) tells administrators the device will set a "Flagged" status written to the log if compromise indicators are found after upgrading, and to inspect configurations for unknown scripts or users regardless. MikroTik staff advised not exposing Winbox, WebFig, or SSH to the internet, using firewall rules or a VPN such as WireGuard instead, and confirmed that many years of RouterOS versions were affected with fixes only from the listed releases. Replies in the same thread carry the earliest publicly posted attack logs, which CERT Polska later dated to September 2, before the patches were released.
-
update from thehackernews.com
Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
thehackernews.com · 37d ago · September 6th, 2026
First-wave news coverage of CERT Polska's September 5 warning that attackers were using RouterOS flaws to take control of devices whose SSH service was reachable from public networks. It confirmed active exploitation and urged immediate patching, but did not yet identify which two flaws formed the chain or how they combined.
-
update from malware.news
Critical MikroTik Vulnerability - Patch Now, (Sun, Sep 6th)
malware.news · 37d ago · September 6th, 2026
Mikrotik released a patch late last week for an already-exploited vulnerability. At this point, assume compromise. Attackers have been adding new accounts to affected devices to maintain access after a patch is installed. Article Link: Are you human? - SANS Internet Storm Center
-
update from gbhackers.com
Hackers Actively Exploiting MikroTik RouterOS MikroTrick Flaws to Take Full Control of Routers
gbhackers.com · 36d ago · September 7th, 2026
Threat actors are actively exploiting critical vulnerabilities in MikroTik RouterOS, collectively known as MikroTrick, to compromise internet-exposed routers and gain complete administrative control. The attacks primarily target devices with SSH management access that are exposed to public networks, prompting urgent patching recommendations from MikroTik, CERT Polska, and Latvia’s national CERT.LV. On September 3, MikroTik issued […] The post Hackers Actively Exploiting MikroTik RouterOS MikroTrick Flaws to Take Full Control of Routers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Hackers Actively Exploit MikroTik RouterOS MikroTrick Flaws to Take Full Control of Routers
cyberpress.org · 36d ago · September 7th, 2026
MikroTik released security updates on September 3, confirming that fixed RouterOS builds are available through supported update channels. Although the company said most default configurations are not immediately exposed, it urged every administrator to update vulnerable devices without delay. Hackers Actively Exploit MikroTik RouterOS MikroTrick Flaws The affected components include the RouterOS SSH server and client, the bandwidth-test service, X.509 certificate handling, and the WebFig web management interface. Researchers identified six RouterOS vulnerabilities, including two critical SSH flaws that attackers can chain to obtain unauthenticated, full-device access. The first issue, CVE-2026-67276, carries a CVSS score of 9.2 and stems from an SSH authentication-bypass vulnerability. RouterOS reportedly fails to fully compare the contents of RSA public keys during authentication. An attacker who knows a valid username and the public modulus associated with that account’s SSH key can generate a different key that passes validation. This enables the attacker to log in without the legitimate private key and
-
update from bleepingcomputer.com
Hackers exploit new MikroTik RouterOS flaws to hijack routers
bleepingcomputer.com · 36d ago · September 7th, 2026
It is an SSH privilege escalation flaw in MikroTik RouterOS due to improper handling of specially crafted usernames. Both vulnerabilities were discovered by Poland's CERT agency with the help of GPT-5.5-cyber and GPT-5.6-sol and received a critical severity rating. The Polish agency dubbed the exploit chain “MikroTrick,” and warned that it is now actively exploited in the wild. “In recent days we have been observing attacks against RouterOS devices accessible from the internet,” Poland's CERT warns .
-
update from socprime.com
CVE-2026-67276: MikroTik RouterOS SSH Zero-Day Exploited in Router Takeover Attacks
socprime.com · 36d ago · September 7th, 2026
The vulnerability becomes significantly more dangerous when combined with CVE-2026-86060, a separate SSH privilege-escalation weakness. Evidence indicates that exploitation began as early as September 2, 2026 , one day before MikroTik publicly released patched RouterOS builds on September 3. Successful attacks have created highly privileged accounts, modified device configuration, and established access that may survive until administrators actively investigate and rebuild compromised systems. However, CVE-2026-67276 and CVE-2026-86060 form the combination currently confirmed in active full-device takeover attacks.
-
update from malware.news
MikroTik router flaws allow takeover without a password
malware.news · 35d ago · September 8th, 2026
Although the warning comes from Poland’s national cybersecurity response team, MikroTik routers are sold worldwide, including in the US. The vulnerabilities can affect users anywhere if their router is running a vulnerable version of RouterOS and its SSH remote-management service is accessible from the internet. A compromised router is especially serious because it sits at the edge of your network. An intruder may be able to change DNS settings, redirect or capture traffic, create remote-access tunnels, alter firewall rules, or use the device as a foothold to attack other devices on the network.
-
update from securityweek.com
MikroTik Patches Critical Flaws Chained to Hack Routers
securityweek.com · 35d ago · September 8th, 2026
Network equipment maker MikroTik has rolled out patches for six vulnerabilities in RouterOS, urging users to apply them as soon as possible, as two of them have been flagged as exploited. In a scarce advisory , MikroTik warns of the identified security defects, recommends immediate patching, and directs users to CERT Poland’s advisory for additional information. “This is an important security update. CERT Poland, meanwhile, says it has received confirmation that two of the resolved vulnerabilities have been chained together to compromise devices. According to the information we have, updating to the latest version prevents these attacks,” CERT Poland notes.
-
update from malware.news
Mikrotik security advisory (AV26-887)
malware.news · 35d ago · September 8th, 2026
Serial Number: AV26-887 Date: September 8, 2026 As of September 5, 2026, Mikrotik is affected by vulnerabilities in the following product: RouterOS Prior to 6.49.21 Prior to 7.23.4 Prior to 7.24.2 Prior to 7.25 beta 3 Open-source reporting indicates that CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060 related to MikroTik are being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
-
update from cyber.netsecops.io
📰 MikroTik Routers Hijacked via 'MikroTrick' Unauthenticated Exploit 🚨 ACTIVE ATTACK: MikroTik routers are being hijacked via the 'MikroTric
cyber.netsecops.io · 35d ago · September 8th, 2026
📰 MikroTik Routers Hijacked via 'MikroTrick' Unauthenticated Exploit 🚨 ACTIVE ATTACK: MikroTik routers are being hijacked via the 'MikroTric
via Mastodon https://cyber.netsecops.io/articles/mikrotik-routers-exploited-via-mikrotrick-ssh-exploit-chain/?utm_source=mastodon&utm_medium=social&utm_campaign=daily
-
mentioned by insomnisec.com
MikroTrick (CVE-2026-67276 & CVE-2026-86060): MikroTik RouterOS Hijacking Is Already Underway If your organization runs a MikroTik router an
insomnisec.com · 35d ago · September 8th, 2026
-
mentioned by go.dhs.gov
We added MikroTik RouterOS vulnerabilities CVE-2026-67277 & CVE-2026-86060 to our KEV Catalog. Visit https:// go.dhs.gov/Z3Q & apply mitigat
go.dhs.gov · 33d ago · September 10th, 2026
-
update from malware.news
AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060
malware.news · 33d ago · September 10th, 2026
Number: AL26-020 Date: September 10, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. Tracked as CVE-2026-67277 Footnote 3 , this vulnerability is a Missing Authentication for Critical Function vulnerability (CWE-306) Footnote 4 that may allow a remote attacker to obtain potentially sensitive information.
-
update from secdb.nttzen.cloud
🚨 [CISA-2026:0910] CISA Adds 2 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
secdb.nttzen.cloud · 33d ago · September 10th, 2026
🚨 [CISA-2026:0910] CISA Adds 2 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
via Mastodon https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0910
-
mentioned by gbhackers.com
CISA Adds Exploited MikroTik RouterOS Flaws to Security Alert
gbhackers.com · 32d ago · September 11th, 2026
-
update from cyberpress.org
CISA Warns MikroTik RouterOS Flaw Is Exploited to Escalate Privileges
cyberpress.org · 32d ago · September 11th, 2026
Successful exploitation lets an attacker alter the trusted RouterOS policy mask, potentially elevating privileges beyond their intended authorization level. CISA Warns MikroTik RouterOS Flaw RouterOS policy masks are used to define access controls and determine which administrative functions a user or process can execute on a MikroTik device. By manipulating the trusted policy mask through the vulnerable command-handling mechanism, a threat actor may obtain expanded permissions and access functions that should normally be restricted. Privilege escalation flaws are particularly dangerous in network infrastructure because compromised routers often sit at critical points within enterprise and service-provider environments.
-
mentioned by endoflife.ai
📖 New from endoflife.ai: MikroTik RouterOS on CISA KEV: 6.49.21 Is the Only Fix for Any 6.x https:// endoflife.ai/article-mikrotik- routeros
endoflife.ai · 32d ago · September 11th, 2026
-
update from thehackernews.com
CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
thehackernews.com · 31d ago · September 12th, 2026
The same batch included CVE-2026-67277, a btest kernel memory disclosure and denial-of-service flaw, CVSS 8.8.
-
update from censys.com
The recent MikroTik RouterOS vulnerabilities have several conditions for exploitation. That may make mass exploitation more difficult, but t
censys.com · 29d ago · September 14th, 2026
That may make mass exploitation more difficult, but t
via Mastodon https://censys.com/podcasts-videos/censys-arc-flash-episode-5/
-
update from cyberpress.org
MikroTik SSH Rekeying and Username Flaws Chain Into Unauthenticated RouterOS Admin Access
cyberpress.org · 25d ago · September 18th, 2026
A compromised MikroTik device could allow attackers to monitor traffic, steal credentials, maintain access, or move deeper into connected networks. MikroTik Flaws Enable Admin Access The first flaw, CVE-2026-67279, affects how RouterOS processes SSH rekeying. Rekeying is a normal SSH operation that replaces encryption keys during a connection. Under normal conditions, SSH follows three steps: establish encryption, authenticate the user, and then permit session activity such as terminal access or command execution.
-
update from cert.pl
MikroTrick: technical analysis, disclosure process, and the use of LLM agents
cert.pl · 22d ago · September 22nd, 2026
It dates attack telemetry to forum logs of Sep 2, one day before the Sep 3 patches, and lists indicators: failed SSH logins for user -2, an ops account in the full-privilege group, and IPs 82.192.72.4 and 103.102.31.18.
-
update from malware.news
MikroTrick: technical analysis, disclosure process, and the use of LLM agents
malware.news · 21d ago · September 22nd, 2026
We explain the mechanics of the attacks observed in the wild, the coordinated disclosure of both vulnerabilities, and the practical role of LLM agents in the RouterOS research.
-
update from euvd.enisa.europa.eu
🚨 EUVD-2026-84569 📊 Score: 8.7/10 (CVSS v3.1) 📦 Product: RouterOS 🏢 Vendor: MikroTik 📅 Updated: 2026-09-22 📝 MikroTik RouterOS before 7.25be
euvd.enisa.europa.eu · 21d ago · September 22nd, 2026
🚨 EUVD-2026-84569 📊 Score: 8.7/10 (CVSS v3.1) 📦 Product: RouterOS 🏢 Vendor: MikroTik 📅 Updated: 2026-09-22 📝 MikroTik RouterOS before 7.25be
via Mastodon https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84569
-
mentioned by thehackernews.com
🤖 MikroTik RouterOS: CERT Polska "MikroTrick" — two SSH flaws chained (CVE-2026-67279 state-machine bug + CVE-2026-86060 argument injection
thehackernews.com · 20d ago · September 23rd, 2026
-
mentioned by malware.news
MikroTik security advisory (AV26-958)
malware.news · 20d ago · September 23rd, 2026
-
mentioned by thehackernews.com
# infosec # vulnerability # exploit MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key
thehackernews.com · 20d ago · September 23rd, 2026
-
mentioned by thehackernews.com
🤖 MikroTik "MikroTrick": two chained RouterOS SSH bugs (CVE-2026-67279 SSH state-machine flaw + CVE-2026-86060 argument injection) give full
thehackernews.com · 20d ago · September 24th, 2026
-
mentioned by thehackernews.com
🤖 CISA KEV: the "MikroTrick" chain (CVE-2026-67279 + CVE-2026-86060) grants unauthenticated full admin access to internet-exposed MikroTik R
thehackernews.com · 17d ago · September 26th, 2026
-
mentioned by thehackernews.com
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild Source: The Hacker News Read: https:// thehackernews.com/2026/09/s
thehackernews.com · 17d ago · September 26th, 2026