On 5 September 2026 CERT Polska published six vulnerabilities in MikroTik RouterOS. Two of them chain into something every network operator should read twice: full control of a router over SSH, without a password, without a private key. CERT Polska calls the chain MikroTrick. It has been exploited in the wild since at least 2 September, two days before the advisory and one day before MikroTik shipped fixes.
If you run MikroTik as branch or customer-premises routers, here is what happened, who is actually exposed, and what to do this week.
What MikroTrick is
Two bugs, one chain. CVE-2026-67276 (CVSS 9.2) is an SSH authentication bypass: RouterOS does not compare the complete RSA public key when it matches a login attempt against the authorized keys. An attacker who knows an authorized key's modulus can present a key with exponent one, forge a valid signature and open an SSH session as that user, with no private key involved. CVE-2026-86060 takes it from there: an argument-handling flaw in the SSH login path lets a username starting with a prohibited character rewrite the policy mask, which is privilege escalation to full admin.
Put together: SSH reachable from the internet plus an unpatched RouterOS equals a router that belongs to someone else. MikroTik fixed both on 3 September in RouterOS 6.49.21, 7.23.4, 7.24.2 and 7.25beta3. CERT Polska has confirmed active exploitation against devices whose SSH service is reachable from public networks.
Already exploited before the patch existed
Attacks were observed from 2 September, the fix came on 3 September, the advisory on 5 September. Any RouterOS device with SSH open to the internet during that window should be treated as possibly compromised, not just as unpatched.
Who is exposed
The chain needs one thing: an SSH service that answers to the public internet. That is the default state of a surprising number of MikroTik routers, because they are cheap, capable and often set up once by whoever was available and then left alone. Branch offices, retail sites, small ISPs, hotspot gateways. The routers are fine. The management plane facing the internet is the problem.
A router whose SSH, Winbox, WebFig and API ports are only reachable from a defined management network is not reachable by this chain at all. Patching still matters, isolation is what buys you the time to do it calmly.
What to do this week
CERT Polska's guidance is short and worth following in this order:
- Update to RouterOS 6.49.21, 7.23.4 or 7.24.2. Updating is the fix, everything else is containment.
- Check for users you did not create and scripts and schedulers you do not recognise. Persistence on a compromised RouterOS is usually a script, not a binary.
- Restrict SSH, Winbox, WebFig and the API to your management addresses, and keep them off the WAN interface entirely. If you cannot restrict, disable the service.
- Rotate credentials and SSH keys on any device that was reachable from the internet while unpatched.
How managed CPEs sit this one out
ZERO-CONNECT customers have MikroTik devices as MPLS CPEs at their own sites, on RouterOS versions that were in scope of this advisory. Nobody could reach them with it. Management access on these managed CPEs is locked to our management source addresses: no SSH, Winbox, WebFig or API from the public internet, on any site, by design and not by exception. The attack chain has no door to knock on.
That does not mean we skip the patch. The fixed RouterOS release went out to every managed CPE over the weekend; the last maintenance window closed on Monday morning, 7 September, two days after the advisory. The customer did not have to track the advisory, plan the update or check for rogue users afterwards. That is the part of "managed" that does not show up on a price list until a week like this one.
The honest part
Management-plane isolation is not a substitute for patching, it is what makes patching a scheduled task instead of an incident. A locked-down router with a nine-year-old firmware is still a liability the day the next bug lands on a different port. Both are needed. The advantage of a managed CPE is not that it is a better router, it is that somebody is paid to do both, every time, for every site.
If you run your own MikroTik estate: update, audit users and scripts, and close the management ports to the internet. If you would rather not run it at all, that is the conversation below.