Hackers Actively Hijack MikroTik Routers Through Critical SSH Flaw Chain
Hackers are actively exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to seize control of devices with SSH services exposed to the internet. The first flaw, tracked as CVE-2026-67276, is an SSH authentication bypass caused by incomplete validation of RSA public keys, allowing an attacker who knows a username and the public modulus of that user's key to log in without the legitimate private key. The second flaw, CVE-2026-86060, is an SSH privilege escalation issue that lets attackers use specially crafted usernames to gain full administrative privileges on the device.
Both vulnerabilities receive a critical severity rating and come from research by Poland's CERT agency, which received assistance from GPT-5.5-cyber and GPT-5.6-sol. The Polish agency dubs the exploit chain "MikroTrick" and warns that attackers are now using it in the wild to fully compromise RouterOS devices accessible from public networks. A third flaw, CVE-2026-67277, affects the RouterOS bandwidth-test service and allows unauthenticated attackers to leak kernel memory or remotely crash and restart affected routers.
MikroTik fixes the vulnerabilities in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, released on September 3, and Poland's CERT validates the patches. The updates also add a compromise-detection mechanism that checks for known signs of unauthorized configuration changes at startup, disables malicious entries, and logs a critical warning. However, the CERT cautions that the absence of a compromise marker does not guarantee a router remains uncompromised, and it publishes indicators of compromise including suspicious SSH log entries for administrators to review.