Full Report
Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet. [...]
Analysis Summary
# Vulnerability: "MikroTrick" SSH Auth Bypass and Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-67276 (SSH Auth Bypass), CVE-2026-86060 (Privilege Escalation), CVE-2026-67277 (Memory Leak/DoS)
- **CVSS Score:** Critical (Numerical score not specified, but rated Critical by CERT.pl)
- **CWE:**
- CVE-2026-67276: CWE-287 (Improper Authentication)
- CVE-2026-86060: CWE-269 (Improper Privilege Management)
- CVE-2026-67277: CWE-401/CWE-125 (Memory Leak/DoS)
## Affected Systems
- **Products:** MikroTik RouterOS
- **Versions:** All versions prior to the fixes (specifically mentions v6 and v7 branches)
- **Configurations:** Devices with SSH services exposed to the internet; bandwidth-test service enabled (for CVE-2026-67277).
## Vulnerability Description
The "MikroTrick" exploit chain combines two flaws to gain full administrative control:
1. **CVE-2026-67276:** An authentication bypass in the SSH service caused by incomplete validation of RSA public keys. If an attacker knows a username and the public modulus of that user's key, they can craft a malicious key to log in without the private key.
2. **CVE-2026-86060:** A privilege escalation flaw triggered by improper handling of specially crafted usernames during an SSH session, allowing an attacker to upgrade their session to full administrative privileges.
3. **CVE-2026-67277:** A flaw in the `bandwidth-test` service that allows unauthenticated attackers to leak kernel memory or cause a remote system crash/restart.
## Exploitation
- **Status:** **Exploited in the wild.** Active attacks observed by Poland's CERT.
- **Complexity:** Low (Attacks facilitated by AI-assisted discovery).
- **Attack Vector:** Network (Remote via SSH).
## Impact
- **Confidentiality:** High (Full access to router configuration, logs, and traffic).
- **Integrity:** High (Ability to add accounts and modify system settings).
- **Availability:** High (Ability to crash the device or disrupt network services).
## Remediation
### Patches
MikroTik released fixes on September 3, 2026. Users should update to the following versions or newer:
- **RouterOS v7:** 7.25beta3, 7.24.2, 7.23.4
- **RouterOS v6:** 6.49.21
### Workarounds
- **Disable/Restrict SSH:** Disable SSH if not needed, or restrict access using firewall rules to trusted IP addresses only.
- **Service Hardening:** Disable `WWW/WWW-SSL` and `bandwidth-test` services if they are exposed to untrusted networks.
- **Avoid Outbound Links:** Avoid using the built-in SSH client or outbound TLS connections over untrusted networks until patched.
## Detection
### Indicators of Compromise (IoCs)
- **Log Entries:**
- `login failure for user -2 from via ssh`
- `user added by ssh:-2@`
- **Accounts:** Presence of an unauthorized "highly privileged ops account."
- **Malicious IPs:**
- `82[.]192[.]72[.]4`
- `103[.]102[.]31[.]18`
### Detection methods and tools
- **Compromise-Detection Mechanism:** Updated RouterOS versions now include a startup check that flags unauthorized configuration changes and logs a critical warning.
- **Incident Response:** If compromise is suspected, isolate the device, preserve logs for analysis, perform a factory reset, and rebuild from a known-good configuration. **Important:** Rotate all passwords, SSH keys, and secrets after rebuilding.
## References
- **Vendor Advisory:** [hxxps://mikrotik[.]com/supportsec/september-2026-vulnerability]
- **CERT.pl Advisory:** [hxxps://cert[.]pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/]
- **MikroTik Manual (Device Mode):** [hxxps://manual[.]mikrotik[.]com/docs/system-information-and-utilities/device-mode/#flagged-status]