MikroTik Router Flaw Allows Hackers to Hijack Routers, Warns Polish CERT Agency
A critical vulnerability in MikroTik routers has been exploited by hackers to take control of devices with SSH services exposed to the internet. The flaw, dubbed “MikroTrick” by Poland’s CERT agency, is a chain of two vulnerabilities that allows attackers to bypass SSH authentication and gain full administrative privileges.
The first issue, CVE-2026-67276, is an SSH authentication bypass flaw caused by incomplete validation of RSA public keys. An attacker who knows a username and the public modulus of that user’s key can exploit it by crafting a different key and logging in without the legitimate private key. The second vulnerability, CVE-2026-86060, is an SSH privilege escalation flaw due to improper handling of specially crafted usernames.
Hackers can leverage these flaws using a combination of both vulnerabilities to manipulate the SSH session and gain full control over devices whose SSH service is accessible from public networks. Poland’s CERT agency has warned that it has observed attacks against RouterOS devices in recent days, with attackers exploiting this combination of vulnerabilities to take control of devices.
MikroTik fixed the vulnerabilities in its latest software updates, released on September 3. The updates add a compromise-detection mechanism to the routers that looks for known signs of unauthorized configuration changes at startup and logs critical warnings. However, users are warned not to rely solely on this feature as a guarantee of security.
According to data provided by The ShadowServer Foundation, there were over 122,500 MikroTik devices with an exposed SSH interface as of September 5. Users who cannot apply the updates immediately are advised to restrict or disable externally accessible SSH services and avoid using built-in SSH clients and outbound TLS connections over untrusted networks.
The CERT agency has also shared indicators of compromise (IoCs) that users can look out for, including log entries indicating login failures from suspicious IP addresses and the presence of a highly privileged ops account. If compromise is suspected, users are advised to isolate the router, preserve logs and configuration, then factory-reset the device and rebuild it from a trusted configuration.
The discovery of this vulnerability highlights the importance of keeping software up-to-date and secure. Users should ensure that their devices are running the latest software version and be aware of potential security risks associated with exposed SSH services. By taking proactive measures to secure their devices, users can minimize the risk of falling victim to such attacks.
Source: Bleeping Computer — 2026-09-07