NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

MikroTik routers taken over without login through MikroTrick SSH flaws

Attackers took over MikroTik routers with SSH exposed to the internet. Install the latest supported RouterOS update and check for unauthorised changes. September's first RouterOS 7 updates left a separate certificate flaw incompletely fixed.

What to do

If you use a MikroTik router, ask whoever manages it to install the latest supported RouterOS release: the complete-fix minimums are 7.24.3, 7.23.6 or 6.49.21 for the corresponding branch. Restrict SSH and WebFig to trusted management networks or a VPN, and have the configuration checked even if there is no Flagged warning. If compromise is suspected, have a professional isolate it, preserve logs, rebuild from a trusted configuration and replace exposed passwords and keys.

Check your devices
  • RouterOS (7.24 branch)fixed in 7.24.3 and later
  • RouterOS (7.23 branch)fixed in 7.23.6 and later
  • RouterOS (6.49 branch)fixed in 6.49.21 and later

What’s happening

Attackers used two RouterOS SSH flaws, CVE-2026-67279 and CVE-2026-86060, together to gain full administrative control without a password or SSH key. CERT Polska confirmed successful attacks from at least 2 September against routers whose SSH service was reachable from the internet. MikroTik's default configuration blocks internet access to management ports, so exposure depends on configuration. The 3 September updates stopped the observed attacks. However, a separate certificate and SSH host-key flaw, CVE-2026-67278, needed further RouterOS 7 fixes. MikroTik's 6 October revision confirms complete coverage in 7.24.3, 7.23.6 and 6.49.21, or later releases. CISA lists both MikroTrick components and the separate bandwidth-test flaw as exploited. The reviewed sources disclose no total of compromised routers or confirmation that attacks have ended. Updating does not establish that an earlier compromise has been cleaned up.

What
Flaw
Affects
MikroTik routers running RouterOS
Affected
RouterOS 6 before 6.49.21: SSH workflow, SSH privilege and bandwidth-test flaws.
RouterOS 7 before 7.23.4, and 7.24 before 7.24.2: SSH workflow, SSH privilege and bandwidth-test flaws.
RouterOS 7.9 and later before the initial fixed releases: RSA SSH public-key authentication flaw.
RouterOS 7.20 and later before the initial fixed releases: WebFig file disclosure.
RouterOS 7 before 7.23.6, and 7.24 before 7.24.3: certificate and SSH host-key verification flaw; 7.23.4 and 7.24.2 have incomplete fixes.
Fixed in
RouterOS 7.24.3 or later: complete fixes for all six flaws.
RouterOS 7.23.6 or later in the 7.23 branch: complete fixes for all six flaws.
RouterOS 6.49.21 or later in the 6.49 branch: all applicable fixes.
CVE
CVE-2026-67279, CVE-2026-86060, CVE-2026-67277, CVE-2026-67276, CVE-2026-67278, CVE-2026-67281
Since
2 Sept 2026
Closed
6 Oct 2026

Timeline

  1. Vendor revised

    MikroTik expanded its advisory to cover all six flaws and corrected its certificate-fix guidance. It told users who installed 7.24.2 or 7.23.4 to update again; 7.24.3, 7.23.6 and 6.49.21 contain all applicable fixes.

  2. CISA added

    CISA added CVE-2026-67279, the authentication-bypass component of MikroTrick, to its Known Exploited Vulnerabilities catalogue.

  3. Update

    CERT Polska's technical analysis identified MikroTrick as CVE-2026-67279 chained with CVE-2026-86060. Together they provided full administrative access without a password or SSH key; CVE-2026-67276 was a separate flaw.

  4. New fixFixed

    MikroTik's release history dates RouterOS 7.24.3 and 7.23.6 to this day. Its revised advisory identifies these as the complete fixes for CVE-2026-67278; RouterOS 6 was unaffected by that flaw.

  5. CISA added

    CISA added CVE-2026-86060 and the separate bandwidth-test flaw CVE-2026-67277 to its Known Exploited Vulnerabilities catalogue.

  6. Made public

    CERT Polska publicly confirmed active exploitation and urged immediate updates. It warned that an absent Flagged warning does not prove a router escaped compromise.

  7. New fixPartly fixed

    MikroTik released RouterOS 7.24.2, 7.23.4, 6.49.21 and 7.25beta3. These stopped the observed SSH attacks, but the RouterOS 7 certificate fix was later found incomplete.

  8. Wider attacksNo fix yet

    CERT Polska traced successful takeovers of MikroTik routers with internet-accessible SSH to at least this date. Attackers created a highly privileged account named ops.

Sources

  1. September 2026 vulnerability — revised 6 OctoberMikroTik · 6 Oct 2026
  2. Critical vulnerabilities in MikroTik RouterOS are being actively exploitedCERT Polska · 5 Sept 2026
  3. MikroTrick: technical analysis, disclosure process, and the use of LLM agentsCERT Polska · 22 Sept 2026
  4. Vulnerabilities in Mikrotik RouterOS softwareCERT Polska · 5 Sept 2026
  5. Known Exploited Vulnerabilities catalogue — official GitHub dataCISA · 30 Oct 2026
  6. RouterOS release history and changelogsMikroTik
  7. Device mode — Flagged statusMikroTik
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from September 2026 · JSON · RSS