{"id":"mikrotik-mikrotrick-router-takeovers-sep-2026","category":"patch","status":"closed","title":"MikroTik routers taken over without login through MikroTrick SSH flaws","tldr":"Attackers took over MikroTik routers with SSH exposed to the internet. Install the latest supported RouterOS update and check for unauthorised changes. September's first RouterOS 7 updates left a separate certificate flaw incompletely fixed.","summary":"Attackers used two RouterOS SSH flaws, CVE-2026-67279 and CVE-2026-86060, together to gain full administrative control without a password or SSH key. CERT Polska confirmed successful attacks from at least 2 September against routers whose SSH service was reachable from the internet. MikroTik's default configuration blocks internet access to management ports, so exposure depends on configuration. The 3 September updates stopped the observed attacks. However, a separate certificate and SSH host-key flaw, CVE-2026-67278, needed further RouterOS 7 fixes. MikroTik's 6 October revision confirms complete coverage in 7.24.3, 7.23.6 and 6.49.21, or later releases. CISA lists both MikroTrick components and the separate bandwidth-test flaw as exploited. The reviewed sources disclose no total of compromised routers or confirmation that attacks have ended. Updating does not establish that an earlier compromise has been cleaned up.","action":"If you use a MikroTik router, ask whoever manages it to install the latest supported RouterOS release: the complete-fix minimums are 7.24.3, 7.23.6 or 6.49.21 for the corresponding branch. Restrict SSH and WebFig to trusted management networks or a VPN, and have the configuration checked even if there is no Flagged warning. If compromise is suspected, have a professional isolate it, preserve logs, rebuild from a trusted configuration and replace exposed passwords and keys.","product":"MikroTik routers running RouterOS","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-67279","CVE-2026-86060","CVE-2026-67277","CVE-2026-67276","CVE-2026-67278","CVE-2026-67281"],"tags":["mikrotik","routeros","router","mikrotrick","authentication-bypass","actively-exploited"],"affected":["RouterOS 6 before 6.49.21: SSH workflow, SSH privilege and bandwidth-test flaws.","RouterOS 7 before 7.23.4, and 7.24 before 7.24.2: SSH workflow, SSH privilege and bandwidth-test flaws.","RouterOS 7.9 and later before the initial fixed releases: RSA SSH public-key authentication flaw.","RouterOS 7.20 and later before the initial fixed releases: WebFig file disclosure.","RouterOS 7 before 7.23.6, and 7.24 before 7.24.3: certificate and SSH host-key verification flaw; 7.23.4 and 7.24.2 have incomplete fixes."],"fixed":["RouterOS 7.24.3 or later: complete fixes for all six flaws.","RouterOS 7.23.6 or later in the 7.23 branch: complete fixes for all six flaws.","RouterOS 6.49.21 or later in the 6.49 branch: all applicable fixes."],"matches":[{"platform":"router","app":"RouterOS (7.24 branch)","bundle":"","fixed":"7.24.3"},{"platform":"router","app":"RouterOS (7.23 branch)","bundle":"","fixed":"7.23.6"},{"platform":"router","app":"RouterOS (6.49 branch)","bundle":"","fixed":"6.49.21"}],"sources":[{"kind":"advisory","title":"September 2026 vulnerability — revised 6 October","url":"https://mikrotik.com/supportsec/september-2026-vulnerability/","by":"MikroTik","date":"2026-10-06"},{"kind":"advisory","title":"Critical vulnerabilities in MikroTik RouterOS are being actively exploited","url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","by":"CERT Polska","date":"2026-09-05"},{"kind":"research","title":"MikroTrick: technical analysis, disclosure process, and the use of LLM agents","url":"https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/","by":"CERT Polska","date":"2026-09-22"},{"kind":"advisory","title":"Vulnerabilities in Mikrotik RouterOS software","url":"https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/","by":"CERT Polska","date":"2026-09-05"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue — official GitHub data","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-10-30"},{"kind":"advisory","title":"RouterOS release history and changelogs","url":"https://mikrotik.com/download/changelogs?channelFilter=&versionFilter=","by":"MikroTik","date":""},{"kind":"advisory","title":"Device mode — Flagged status","url":"https://manual.mikrotik.com/docs/system-information-and-utilities/device-mode/","by":"MikroTik","date":""}],"started":"2026-09-02","closed":"2026-10-06","created":"2026-11-03T21:38:04.375Z","updated":"2026-11-03T21:38:04.375Z","cve_notes":[{"cve":"CVE-2026-67279","name":"Authentication bypass in RouterOS SSH","what":"RouterOS SSH accepts session requests before authentication, enabling unauthorised commands and, with CVE-2026-86060, full administrative access.","severity":"unknown","cvss":0},{"cve":"CVE-2026-86060","name":"Privilege escalation in RouterOS SSH login","what":"Incorrect username handling in RouterOS SSH login lets an attacker manipulate session permissions, providing full control when chained with CVE-2026-67279.","severity":"unknown","cvss":9.2},{"cve":"CVE-2026-67277","name":"Unauthenticated RouterOS bandwidth-test memory disclosure","what":"Missing authentication and memory-handling flaws in RouterOS bandwidth-test let a remote attacker expose kernel memory or restart the router.","severity":"unknown","cvss":8.8},{"cve":"CVE-2026-67276","name":"RSA public-key authentication bypass in RouterOS SSH","what":"Incomplete RSA key checks in RouterOS SSH let an attacker with account and public-key information impersonate that user without the private key.","severity":"unknown","cvss":9.2},{"cve":"CVE-2026-67278","name":"Forged certificate and SSH host-key acceptance in RouterOS","what":"Faulty signature verification in RouterOS 7 lets an attacker on the network path impersonate servers using forged certificates or SSH host keys.","severity":"unknown","cvss":0},{"cve":"CVE-2026-67281","name":"Unauthenticated file disclosure in RouterOS WebFig","what":"A file-authorisation flaw in RouterOS WebFig lets an unauthenticated attacker read router files, including stored credentials.","severity":"unknown","cvss":0}],"timeline":[{"at":"2026-10-06","added":"2026-11-03T21:35:43.306Z","kind":"vendor-revised","text":"MikroTik expanded its advisory to cover all six flaws and corrected its certificate-fix guidance. It told users who installed 7.24.2 or 7.23.4 to update again; 7.24.3, 7.23.6 and 6.49.21 contain all applicable fixes.","url":"https://mikrotik.com/supportsec/september-2026-vulnerability/","by":"MikroTik","patch":null},{"at":"2026-09-25","added":"2026-11-03T21:35:43.306Z","kind":"cisa-added","text":"CISA added CVE-2026-67279, the authentication-bypass component of MikroTrick, to its Known Exploited Vulnerabilities catalogue.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-09-22","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"CERT Polska's technical analysis identified MikroTrick as CVE-2026-67279 chained with CVE-2026-86060. Together they provided full administrative access without a password or SSH key; CVE-2026-67276 was a separate flaw.","url":"https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/","by":"CERT Polska","patch":null},{"at":"2026-09-15","added":"2026-11-03T21:35:43.306Z","kind":"new-fix","text":"MikroTik's release history dates RouterOS 7.24.3 and 7.23.6 to this day. Its revised advisory identifies these as the complete fixes for CVE-2026-67278; RouterOS 6 was unaffected by that flaw.","url":"https://mikrotik.com/download/changelogs?channelFilter=&versionFilter=","by":"MikroTik","patch":"patched"},{"at":"2026-09-10","added":"2026-11-03T21:35:43.306Z","kind":"cisa-added","text":"CISA added CVE-2026-86060 and the separate bandwidth-test flaw CVE-2026-67277 to its Known Exploited Vulnerabilities catalogue.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-09-05","added":"2026-11-03T21:35:43.306Z","kind":"disclosed","text":"CERT Polska publicly confirmed active exploitation and urged immediate updates. It warned that an absent Flagged warning does not prove a router escaped compromise.","url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","by":"CERT Polska","patch":null},{"at":"2026-09-03","added":"2026-11-03T21:35:43.306Z","kind":"new-fix","text":"MikroTik released RouterOS 7.24.2, 7.23.4, 6.49.21 and 7.25beta3. These stopped the observed SSH attacks, but the RouterOS 7 certificate fix was later found incomplete.","url":"https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/","by":"CERT Polska","patch":"partial"},{"at":"2026-09-02","added":"2026-11-03T21:35:43.306Z","kind":"wider-attacks","text":"CERT Polska traced successful takeovers of MikroTik routers with internet-accessible SSH to at least this date. Attackers created a highly privileged account named ops.","url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","by":"CERT Polska","patch":"none"}],"url":"https://hard.fyi/live/mikrotik-mikrotrick-router-takeovers-sep-2026/","json":"https://hard.fyi/api/live?id=mikrotik-mikrotrick-router-takeovers-sep-2026"}