As reported by BleepingComputer, threat actors are actively exploiting a chain of two critical vulnerabilities in MikroTik RouterOS — dubbed "MikroTrick" by Poland's CERT — to seize full administrative control of routers with SSH services exposed to the public internet. This is not a theoretical risk; confirmed attacks are underway, and the exploit chain requires only knowledge of a username and the public modulus of that user's RSA key.
Vulnerability Details
| CVE | Type | Severity | Description |
|---|---|---|---|
| CVE-2026-67276 | SSH Authentication Bypass | Critical | Incomplete validation of RSA public keys allows login without the legitimate private key |
| CVE-2026-86060 | SSH Privilege Escalation | Critical | Crafted usernames enable manipulation of SSH session to gain full admin privileges |
| CVE-2026-67277 | Bandwidth-Test Memory Leak / DoS | High | Unauthenticated kernel memory disclosure or remote crash/restart via bandwidth-test service |
Patch Status
Patches are available. MikroTik released fixed versions on September 3, 2026: RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. The updates also include a compromise-detection mechanism that scans for unauthorized configuration changes at startup, disables malicious entries, and logs critical warnings.
Active Exploitation Confirmed
Poland's CERT reports confirmed in-the-wild exploitation. Two IP addresses have been linked to attacks: 82.192.72.4 (confirmed successful compromises) and 103.102.31.18 (observed exploitation attempts).
Why This Matters
Edge devices like routers are perennial high-value targets because they sit at the network perimeter, handle all traffic, and are frequently overlooked in patching cycles. MikroTik devices in particular have a long history of being co-opted — from botnet conscription to cryptocurrency mining campaigns. The MikroTrick chain is especially dangerous because it combines authentication bypass with privilege escalation, meaning an attacker can move from unauthenticated access to full device compromise in a single, automated sequence.
The fact that these vulnerabilities were identified with the assistance of AI models (GPT-5.5-cyber and GPT-5.6-sol) is notable — it signals that AI-assisted vulnerability discovery is becoming a standard tool for both offensive and defensive security teams. Defenders should expect the pace of CVE disclosure to accelerate as these capabilities mature.
Who Is at Risk
Indicators of Compromise
Check device logs for the following entries:
login failure for user -2 from <ip> via sshuser <name> added by ssh:-2@<ip>
Also inspect for the presence of an unexpected ops account with elevated privileges, and review connections to IPs 82.192.72.4 and 103.102.31.18.
Note: The absence of compromise markers does NOT guarantee a router hasn't been compromised. Threat actors may have cleared logs or used techniques that don't trigger the detection mechanism. When in doubt, factory-reset and rebuild from a known-good configuration.
Shield53 Recommendations — Immediate Actions
- Patch immediately — Upgrade to RouterOS 7.24.2 (stable), 7.25beta3 (beta), 7.23.4, or 6.49.21 depending on your branch. Do not delay.
- Disable internet-facing SSH — If SSH access from the public internet is not strictly required, disable it. Use Winbox, VPN, or a management VLAN instead. If SSH must remain exposed, restrict it to specific source IPs via firewall rules.
- Hunt for compromise — Review logs for the IoCs above. Check for rogue accounts, unexpected cron jobs, modified firewall rules, or altered DNS settings that could redirect traffic.
- Factory-reset if compromised — If any IoCs are present, isolate the device, preserve logs and configuration for forensic review, perform a factory reset, and rebuild from a verified backup — not the current (potentially tampered) configuration.
- Audit bandwidth-test service — Disable the bandwidth-test feature if not actively needed, given CVE-2026-67277's exposure of kernel memory.
- Enforce key-based SSH with strong key hygiene — Even after patching, ensure RSA keys are unique per device, rotated regularly, and that no default credentials remain in place.
- Monitor outbound traffic — Compromised routers are frequently used as proxies or for lateral movement. Watch for unusual outbound connections, especially to known botnet C2 infrastructure.
Edge device security remains one of the most under-resourced areas in enterprise security. These devices process all network traffic, hold routing credentials, and often serve as VPN endpoints — yet they're frequently managed by teams without dedicated security oversight. The MikroTrick campaign is a reminder that perimeter infrastructure demands the same patching urgency and monitoring rigor as any server or endpoint fleet.
