MikroTik RouterOS Flaws and the SOHO Router Attack Surface
CISA added MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalog in September 2026, and CERT Polska warned about exploitation in the wild. The case is a reminder that consumer and small office routers remain a durable target precisely because they are widely deployed, rarely updated and frequently reachable from the internet.
The flaws
CVE-2026-67279 and CVE-2026-86060 are rated 9.2 and were reported as chained in exploitation. CVE-2026-86060 involves parameter injection in the SSH login path leading to privilege escalation. The described remediation is to upgrade to the fixed releases, cited as 6.49.21, 7.23.4 or 7.24.2 depending on the branch. The National Cyber Security Centre of Poland issued a warning that these were being exploited, and CISA added the chain to the catalog.
Why routers keep appearing in this category
A router sits at the boundary between a network and the internet, which makes it valuable both as a target and as a position to attack from. The management interface is often exposed for remote administration, firmware updates are manual on many models, and default credentials persist where administrators never change them. When a router is compromised, the consequences divide into two groups: the operator loses control of the device that governs their traffic, and the wider internet gains another node for scanning, proxying or distributed attacks.
The Chinese national computer virus emergency center and national internet emergency center have repeatedly warned about IoT devices being turned into botnet nodes, and reporting on residential camera and router incidents describes the same pattern of weak credentials and unpatched firmware as the common cause.
Practical hardening
The measures are familiar because the weaknesses are. Remove remote management exposure from the internet or restrict it to a trusted address list. Change default credentials and disable unused services such as Telnet where a newer administration path exists. Keep firmware current and check the vendor support status, since a device without updates is a permanent liability rather than a pending task. Where the device supports it, separate the guest network from the internal network so that one compromised client does not provide a path inward.
Limits
The KEV entry and the national warning establish that these specific flaws are exploited. The broader claims about router exposure come from general reporting and industry analysis rather than a per model measurement in this article.
References
- CSDN, Week 2 September 2026 cybersecurity situation report, https://blog.csdn.net/weixin_41905135/article/details/165064980
- CSDN, Daily security intelligence report 2026-09-22, https://m.blog.csdn.net/weixin_45635831/article/details/166323355
Top comments (0)