CISA Adds Two of Six Exploited MikroTik RouterOS Flaws to KEV

An attacker who can reach a MikroTik router's SSH or bandwidth-test service over the network can take it over without a password, using flaws that Poland's CERT Polska disclosed on Sept. 5, and the U.S. Cybersecurity and Infrastructure Security Agency added two of those flaws to its Known Exploited Vulnerabilities catalog on Thursday, according to CISA's alert.

CERT Polska researcher Sławomir Rozbicki disclosed six CVE identifiers in total, according to the team's own advisory, all fixed in RouterOS versions 6.49.21, 7.23.4 and 7.24.2.

The timeline, dated

• Sept. 2: An attacker at IP address 82.192.72.4 begins login attempts against exposed RouterOS devices, Help Net Security reported, citing CERT Polska's findings.
• Sept. 3: MikroTik ships the patched versions.
• Sept. 5: CERT Polska publishes its advisory naming six CVEs.
• Sept. 7: Help Net Security and BleepingComputer report exploitation already under way.
• Sept. 10: CISA adds CVE-2026-67277 and CVE-2026-86060 to its KEV catalog.

The score CISA left off its own list

CERT Polska calls the combination of CVE-2026-67276 and CVE-2026-86060 "MikroTrick," a two-step chain that lets an attacker who knows a valid user's RSA key modulus forge a signature and open an SSH session as that user, then escalate to full control. Both halves of that chain carry the same CVSS score.

CVE	CVSS	In CISA's KEV catalog
CVE-2026-67276	9.2	No
CVE-2026-86060	9.2	Yes, Sept. 10
CVE-2026-67277	8.8	Yes, Sept. 10

CISA's catalog carries the escalation half of MikroTrick and a separate, lower-scored bug, but not the authentication-bypass half that makes the chain work without a password. Federal civilian agencies are bound to remediate only what is in the catalog, under Binding Operational Directive 26-04, so an agency patching strictly to CISA's list would still close the door on only one of the two moves an attacker needs.

What the DoS bug does on its own

CVE-2026-67277 does not need the SSH chain at all. It targets RouterOS's bandwidth-test service, where a flaw in session-state handling lets an unauthenticated client trigger a kernel buffer leak or crash the device outright, CERT Polska's advisory said. It carries no privilege requirement, which is why CISA rated it worth adding even though its 8.8 score sits below the SSH bugs.

How to check for compromise

Administrators can check authentication logs for login attempts using a username of "-2," an artifact of the exploit technique, alongside connections from 82.192.72.4, Help Net Security reported. CERT Polska said it withheld working exploit code and left out details that would make automating the attack easier.

The pattern echoes the reasoning behind two of the site's other recent patch stories: a browser vendor shipping its sixth zero-day patch of the year under active exploitation, and the broader monthly cycle covered in September's roundup of competing patch priorities, where CVSS order and exploitation order also diverged. CISA did not say whether it plans to add CVE-2026-67276 to the KEV catalog, or why it was left off this round.