MikroTik Patches RouterOS Flaws Attackers Exploited First

MikroTik shipped patches for a pair of chained RouterOS vulnerabilities on Sept. 3, a day after attackers were already exploiting them, according to Poland's national CERT and the company's own advisory.

CERT Polska said it discovered six RouterOS vulnerabilities and coordinated their disclosure with the Latvia-based router maker. Two of them chain into an attack CERT Polska named MikroTrick: an unauthenticated attacker who knows a valid username can take full administrative control of any RouterOS device with SSH reachable from the internet. The Cybersecurity and Infrastructure Security Agency added two of the six, CVE-2026-67277 and CVE-2026-86060, to its Known Exploited Vulnerabilities catalog on Sept. 10, giving federal agencies until Sept. 13 to remediate. That deadline has passed, and CISA's catalog entry does not say how many agencies met it.

How the MikroTrick chain works

The first stage, CVE-2026-67276, carries a CVSS score of 9.2. RouterOS checks only the type and modulus of an SSH RSA public key during authentication, not its exponent, so an attacker who knows a valid username and the corresponding modulus can submit a forged key with an exponent of one and log in without the real private key.

From that authenticated session, the second stage, CVE-2026-86060, lets a username beginning with a prohibited character corrupt the SSH login helper's handling of argument delimiters. That corruption rewrites the session's trusted policy mask, handing the attacker full administrative rights. CERT Polska rated it 9.2 as well.

A third, unrelated flaw, CVE-2026-67277, sits in RouterOS's bandwidth-test service and carries a CVSS score of 8.8. It lets an unauthenticated connection reach a state normally reserved for logged-in users, and combined with a leak of uninitialized packet-buffer data, it can disclose kernel memory or crash the device into a restart.

Who found it, and how

CERT Polska credited the discovery to Sławomir Rozbicki of its own team, who used the GPT-5.5-cyber and GPT-5.6-sol models in an agent-based research environment made available through the team's access to OpenAI's Government and Trust Agency Collaboration program, the advisory said. CERT Polska traced confirmed exploitation, including creation of a highly privileged account named "ops," to the IP address 82.192.72.4, active since at least Sept. 2, with further attempts from 103.102.31.18.

MikroTik's own advisory withheld technical detail when it first posted the fix. "To give time to update your systems, we are not currently publishing detailed information," the company said.

CVE	CVSS	Flaw
CVE-2026-67276	9.2	SSH key check ignores the exponent, accepting a forged key
CVE-2026-86060	9.2	Login helper mishandles a crafted username, rewrites policy mask
CVE-2026-67277	8.8	Bandwidth-test service skips authentication entirely

A large, unpatched fleet

The Shadowserver Foundation counted more than 122,500 internet-facing RouterOS SSH instances in a single scan on Sept. 5, two days after fixed builds became available in RouterOS 6.49.21, 7.23.4, 7.24.2 and the 7.25 beta. That figure covers only devices with SSH exposed to the internet, not the larger population of RouterOS deployments behind firewalls, which CERT Polska's advisory does not attempt to estimate.

The pattern echoes a problem The Terminal has covered before: a fix existing does not mean a fleet is patched, and CISA's own three-day deadlines apply only to the federal agencies it can compel. MikroTik has not said how many customer devices remain vulnerable, and CERT Polska has not said whether exploitation is continuing past Sept. 5.