Measuring the MikroTik Attack Surface Behind the MikroTrick Campaign

MikroTik RouterOS runs on routers, firewalls, and wireless access points in enterprise networks, ISPs, and small offices. In September 2026, CERT Polska warned that attackers were using a chain of flaws to take full control of exposed devices without authentication. The chain is named MikroTrick, and the size of the affected population is the reason the warning matters.

The evidence

ZoomEye searches for the RouterOS product fingerprint returned the following counts at the time of collection:

Query	Count
app="MikroTik RouterOS"	937,854
app="MikroTik RouterOS" && service="ssh"	830,026
app="MikroTik RouterOS" && port=22	506,031
app="MikroTik RouterOS" && country="US"	27,752
service="ssh" && banner="RouterOS"	43

These counts describe product assets that match the fingerprint. They do not confirm a vulnerable firmware version, and they do not confirm that SSH public key authentication is configured, which is a precondition for CVE-2026-67276.

The spread between the queries is informative. The broad product fingerprint returns 937,854. Adding the SSH service condition returns 830,026, which suggests that SSH is present on a large majority of the matched RouterOS assets. Adding a port 22 condition returns 506,031, a lower figure that reflects how ZoomEye indexes port data versus service banners. The narrow service="ssh" && banner="RouterOS" query returns only 43, which shows how much a banner-string match restricts the result set compared with a product fingerprint.

The flaw chain

MikroTrick combines CVE-2026-67277, missing authentication for a critical function, and CVE-2026-86060, improper neutralization of argument delimiters. A related flaw, CVE-2026-67276, is an SSH public key authentication bypass rated CVSS 3.1 9.8. RouterOS's SSH implementation compares only the key type and modulus when matching a public key and ignores the RSA exponent. An attacker can craft a key with an exponent of 1, which reduces signature verification to an identity operation, and authenticate with only the victim's public key modulus.

The exploitation conditions are specific: SSH public key authentication must be configured, and the SSH service must be reachable. The ZoomEye counts above cannot confirm either condition. They measure how many RouterOS assets exist and how many expose SSH, which is the population from which vulnerable instances would be drawn.

Independent exposure figures

QiAnXin's asset measurement platform reported 198,291 risk assets and 117,848 associated IP addresses in China, and 2,734,151 risk assets with 2,034,183 associated IP addresses globally. Those figures are larger than the ZoomEye product count because they measure a different thing: risk assets associated with the vulnerability, not product fingerprints. The two datasets answer different questions and should not be compared as if they were the same measurement.

CERT Polska published its warning on 5 September 2026 and reported exploitation from 2 September 2026. CISA added CVE-2026-67277 and CVE-2026-86060 to the KEV catalog on 10 September 2026 with a federal deadline of 13 September 2026.

Using the data

An asset search for a widely deployed edge product is most useful when it narrows a response. The sequence that follows from the queries above:

1. Start from the product fingerprint to establish how many RouterOS assets exist in the environment.
2. Add the SSH condition to identify which of them expose the service the flaw chain uses.
3. Filter by geography or organization where the deployment is known, to separate managed assets from ones that were installed and forgotten.
4. Check each reachable asset for SSH public key authentication. That configuration is the precondition, and it is not visible from outside.
5. Verify the firmware version against the fixed builds: 6.49.21, 7.23.4, or 7.24.2.

The value of the external view is that it does not depend on the internal inventory being complete. A router installed by a branch office and never registered centrally still appears in a product fingerprint search.

Limitations

A product fingerprint count is a snapshot. Assets are added, removed, and re-fingerprinted continuously, so the counts above carry the collection date and should be re-run rather than reused. More importantly, product presence is not vulnerability. A RouterOS device running a fixed build is still a RouterOS device, and it still appears in every query above. The counts describe the size of the population to review, not the number of affected systems.

References

• CERT Polska, vulnerabilities in MikroTik RouterOS actively exploited, 5 September 2026.
• NVD entries for CVE-2026-67277, CVE-2026-86060, and CVE-2026-67276.
• CISA Known Exploited Vulnerabilities catalog, entries added 10 September 2026, federal deadline 13 September 2026.
• QiAnXin asset measurement data on RouterOS exposure.
• ZoomEye asset search, queries executed 19 September 2026.