Full Report
The CERT Polska team has identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS, including two critical ones. The vulnerabilities are already being actively exploited to take over devices whose SSH service is accessible from the internet. We recommend immediately updating devices to the patched versions and verifying the configuration for signs of compromise.
Analysis Summary
# Vulnerability: MikroTrick (MikroTik RouterOS Multi-Vulnerability Chain)
## CVE Details
* **CVE-2026-67276**
* **CVSS Score:** 9.2 (Critical)
* **CWE:** Improper Authentication (RSA Public Key validation failure)
* **CVE-2026-86060**
* **CVSS Score:** 9.2 (Critical)
* **CWE:** Privilege Escalation (Improper Username Handling)
* **CVE-2026-67277**
* **CVSS Score:** 8.8 (High)
* **CWE:** Information Exposure / Integer Underflow (Bandwidth-test service)
* *Note: Three additional vulnerabilities were identified but not detailed in this specific report summary.*
## Affected Systems
* **Products:** MikroTik RouterOS
* **Versions:** All versions prior to the patches listed below (affects both v6 and v7 branches).
* **Configurations:** Devices with the SSH service or bandwidth-test service accessible from public networks/internet.
## Vulnerability Description
The "MikroTrick" chain involves two primary flaws:
1. **Authentication Bypass (CVE-2026-67276):** RouterOS failed to compare the entire RSA public key during SSH authentication. An attacker knowing a username and the public modulus of a registered key could craft a malicious key to log in without the private key.
2. **Privilege Escalation (CVE-2026-86060):** By using crafted usernames starting with disallowed characters, an attacker could bypass restricted shell environments to gain full administrative privileges.
3. **Memory Leak/DoS (CVE-2026-67277):** Flaws in the `bandwidth-test` service allowed unauthenticated users to trigger an integer underflow, leading to kernel memory disclosure or a system crash.
## Exploitation
* **Status:** **Exploited in the wild.** Active attacks are occurring to take full control of devices.
* **Complexity:** Medium (requires knowledge of target usernames/public moduli for the bypass).
* **Attack Vector:** Network (Remote via SSH).
## Impact
* **Confidentiality:** High (Full device takeover and memory leakage).
* **Integrity:** High (Ability to modify configuration, scripts, and tunnels).
* **Availability:** High (Potential for Remote DoS/System restarts).
## Remediation
### Patches
MikroTik has released the following patched versions. Users should update immediately:
* **RouterOS v7:** 7.25beta3, 7.24.2, 7.23.4
* **RouterOS v6:** 6.49.21
### Workarounds
* **Disable Services:** Immediately disable or restrict access to the SSH service and `bandwidth-test` service from the internet.
* **IP Filtering:** Use firewall rules to allow SSH access only from trusted, known IP addresses.
## Detection
* **Indicators of Compromise (IoC):**
* Presence of unknown users in the configuration.
* Unfamiliar scripts or scheduled tasks (`/system script` or `/system scheduler`).
* Unauthorized proxy servers, SOCKS settings, or unexpected tunnels (VPNs).
* **"Flagged" Marker:** Patched versions may include a "Flagged" system marker if the update detects potential signs of prior compromise. Do not clear this marker until a full forensic analysis is performed.
* **Verification:** Do not restore full backups from potentially compromised dates, as they may contain persistent backdoors.
## References
* MikroTik Security Advisory: [https://mikrotik.com/supportsec/september-2026-vulnerability/](https://mikrotik.com/supportsec/september-2026-vulnerability/)
* CERT Polska Advisory: [https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve](https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve)