CERT Polska disclosed six vulnerabilities in MikroTik RouterOS on September 5 and confirmed that attackers have been chaining two of them, in a combination the agency named MikroTrick, to take full administrative control of internet-exposed routers without any authentication at all, with observed attacks dating back to at least September 2.

The chain combines CVE-2026-67276, an SSH authentication bypass caused by RouterOS failing to validate a user’s entire RSA public key, with CVE-2026-86060, a flaw in how RouterOS handles specially crafted usernames during SSH login that lets an attacker escalate a session to full administrator privileges. CERT Polska said the vulnerable components span the SSH server and client, the bandwidth-test service, X.509 certificate handling, and the WebFig web interface, and that MikroTik’s fixes, released in versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, stop the observed attacks. In an unprecedented step for the company, MikroTik pushed a notification directly to the phones of users running its mobile app urging them to update.

The original insight here is in the detection guidance, not the exploit chain: MikroTik’s fixed releases add a startup scan that flags known signs of unauthorized configuration changes, but CERT Polska was explicit that the absence of a flag “is not proof that the device is safe,” since the mechanism only catches selected traces of compromise. Administrators who patch and see no warning cannot assume they were never hit, they still need to manually check for unknown user accounts, scheduler tasks, proxy configurations, and tunnels, the same categories CERT Polska and recent unauthenticated root-access advisories on other network platforms have both flagged as post-compromise indicators.

Security teams managing MikroTik infrastructure should patch immediately, restrict SSH, WebFig, and bandwidth-test access to trusted management networks in the meantime, and audit configurations regardless of whether the device shows a “Flagged” warning. The broader lesson tracks a pattern this publication has covered before: authentication and isolation boundaries in widely deployed infrastructure software keep failing in ways vendors did not anticipate, and CERT-level detection guidance should be treated as a floor, not a guarantee.

Source: CERT Polska