MikroTrick: How Two SSH Flaws Let Attackers Take Over MikroTik Routers Without Credentials

Routers are the devices network teams configure once and then stop looking at. The MikroTrick exploit chain, disclosed by CERT Polska in September 2026, shows what that neglect costs when the management interface is reachable from the internet.

What the chain does

MikroTrick combines two vulnerabilities in MikroTik RouterOS. CVE-2026-67276 is an SSH public-key authentication bypass. CVE-2026-86060 is a privilege escalation reached through a malformed username. Chained together, they allow an unauthenticated attacker who can reach the SSH service to take full administrative control of the device. Both are rated critical, with reported CVSS scores around 9.2 to 9.8 depending on the source.

The authentication bypass in detail

The bypass is a logic error in how RouterOS verifies RSA public keys. When matching a client key, the SSH implementation compares the key type and the modulus but ignores the RSA exponent entirely. During signature verification it then uses the public-key parameters supplied by the client.
An attacker can exploit this by forging a public key whose exponent is 1. With an exponent of 1, the RSA signature verification operation degenerates into an identity operation: the value that comes out equals the value that went in. The attacker does not need the private key. Knowing the victim's public-key modulus and the username is enough to authenticate.
The practical precondition is that the target account has SSH public-key authentication configured and that the SSH service is reachable over the network. Both are common on internet-facing MikroTik devices.

Escalation and takeover

Once authenticated, the second flaw raises the session to full administrator. CERT Polska describes it as improper neutralization of argument delimiters, triggered through a crafted username. The result is complete device control: traffic can be intercepted, routing and firewall rules can be rewritten, and the device can be repurposed as a proxy or tunnel.

Timeline and observed exploitation

The exploitation began before the patch existed. CERT Polska recorded attacker activity from 2 September 2026, while MikroTik released fixed versions on 3 September. This makes it a zero-day event in the strict sense: attacks were underway before defenders had a fix to apply.
CISA added the RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalog on 10 September, with a federal remediation deadline of 13 September.

Indicators of compromise

Reported intrusion indicators are specific enough to check directly:

• SSH login attempts using the invalid username -2, appearing in logs as ssh:-2@
• Unauthorized high-privilege accounts on the device, particularly one named ops
• Devices marked with the Flagged state, a detection mechanism MikroTik added in the patched firmware that runs a self-check at boot for known tampering
• Reported attack source addresses including 82.192.72.4 and 103.102.31.18 The Flagged mechanism is worth understanding. It does not prevent compromise. It records that the device shows signs of known modification, which is useful during triage but only after the firmware has been upgraded. ## Fixed versions and mitigations MikroTik released fixes across its release trains:
• RouterOS 6.x (long-term): 6.49.21 or later
• RouterOS 7.x (long-term): 7.23.4 or later
• RouterOS 7.x (stable): 7.24.2 or later
• A further 7.23.5 build was issued on 4 September Where immediate upgrade is not possible, the interim measures are to restrict SSH access to trusted management addresses and to disable or restrict the bandwidth-test service. These reduce reachability; they do not fix the authentication logic. Devices that were reachable over the internet while unpatched should be treated as potentially compromised rather than merely vulnerable. CERT Polska's guidance is explicit on this point. ## Why this class of device keeps appearing MikroTik equipment is common in small and medium businesses, internet service providers and branch offices. These deployments share three properties that make them attractive: long service life, infrequent maintenance, and a management interface that is often exposed for remote administration. A router that has been taken over sits at a trust boundary, so the compromise extends beyond the device itself. The authentication bypass is also notable for what it breaks. SSH public-key authentication is normally treated as stronger than passwords because it requires possession of a private key. MikroTrick defeats that assumption without the private key, which is why the flaw is more serious than a typical credential-guessing exposure. ## Defensive implications The immediate actions are upgrade, restrict, and verify. Upgrade to a fixed RouterOS version. Restrict SSH, WebFig and bandwidth-test access to trusted management networks rather than the public internet. Then verify: check logs for the -2 username, list accounts and remove anything unrecognized, and check whether the device reports a Flagged state. For devices confirmed compromised, the reported guidance is to isolate the device, examine configuration changes for malicious entries, and ensure unauthorized accounts are removed before any return to service. A factory reset without first capturing evidence discards the information needed to understand what the attacker did. The broader lesson is about exposure management. A management interface that is reachable from the internet is a standing invitation, and the patch-to-exploitation gap here was negative: attacks started before the fix was published. ## References
• CERT Polska advisory on actively exploited MikroTik RouterOS vulnerabilities, September 2026
• MikroTik RouterOS release notes for 6.49.21, 7.23.4, 7.23.5 and 7.24.2
• CISA Known Exploited Vulnerabilities catalog update, 10 September 2026
• NVD records for CVE-2026-67276 and CVE-2026-86060