Your MikroTik router may already belong to someone else.

Attackers are chaining two now-patched RouterOS vulnerabilities to seize full administrative control of internet-facing devices — with no credentials at all. CERT Polska gave the chain a name: MikroTrick. Confirmed exploitation dates back to at least September 2, 2026, a day before MikroTik shipped fixes. If your router’s SSH port is reachable from the internet, stop what you’re doing and patch.

What MikroTrick is

MikroTrick links two separate flaws discovered by CERT Polska and disclosed on September 5, 2026:

CVE-2026-67276 (CVSS 9.2) — SSH authentication bypass. RouterOS verifies the key type and modulus of an RSA public key during SSH login, but it never checks the exponent. Because signature verification runs against the client-supplied key, an attacker who knows an authorized user’s public modulus can submit a crafted key with an exponent of one and forge a valid signature. No private key required. The attacker walks in as that user. This one hits the RouterOS 7.x branch only.

CVE-2026-86060 (CVSS 9.2) — privilege escalation via a crafted username. RouterOS passes the SSH username straight to a login-helper program. A username beginning with a disallowed character twists that argument handling and flips the trusted RouterOS policy mask — escalating the session to full root-level admin. No authentication involved.

Chained together, the two let an outsider authenticate as an existing user and instantly escalate to complete OS-level control. An attacker only needs to reach the router’s SSH service — a condition any internet-exposed SSH port meets.

The scale of the problem

Shadowserver Foundation scans on September 5 found more than 120,000 MikroTik devices with SSH reachable from the public internet in a single 24-hour window. The heaviest concentrations sit in Brazil, the United States, and Indonesia. CERT Polska observed attackers operating from two IP addresses (82.192.72.4 and 103.102.31.18) and creating a rogue account named “ops” on compromised boxes.

MikroTik’s own telemetry adds a fingerprint of the campaign: a script named logrotate and a scheduler called daily-maint that silently recreate a full-privilege account every 24 hours if someone removes it. Real routers bearing this footprint have been found in the wild. This is active incident response, not a routine patch cycle.

CISA weighs in

On September 10, CISA added CVE-2026-86060 and a companion flaw, CVE-2026-67277 (a missing-authentication bug in the bandwidth-test service that leaks kernel memory or triggers a remote denial-of-service), to its Known Exploited Vulnerabilities (KEV) catalog — and designated CVE-2026-86060 as requiring forensic triage under Binding Operational Directive 26-04. The agency set a September 13 mitigation deadline for federal civilian agencies. Canada’s Cyber Centre issued a parallel alert urging immediate attention to internet-exposed SSH systems.

How to fix it now

1. Upgrade immediately. Fixed builds are RouterOS 6.49.21 (long-term 6.x), 7.23.4 (long-term 7.x), and 7.24.2 (stable). The 7.25 beta 3 build also has the fix, but use a supported stable or long-term release. MikroTik confirmed the updates stop the observed attacks.

2. Kill internet-facing SSH if you can. SSH reachable from the public internet is the trigger for the whole chain. Restrict management to trusted IPs or a VPN, and disable the service on the WAN interface where feasible.

3. Assume compromise, then check. Patching does not undo a prior takeover. Aud your device for:

• An unknown user named “ops”
• Unexpected scripts, schedulers, proxy servers, or tunnels
• Configuration objects owned by user ID “0”

4. Check the “Flagged” state and remote logs. MikroTik added a “Flagged” indicator that appears in the log section when the configuration shows signs of unauthorized modification. Local logs are volatile and often wiped on reboot — preserve configuration and logs before you reset anything.

5. Rebuild clean and rotate everything. If you find indicators of compromise, don’t just delete the rogue account. Rebuild from a verified baseline and rotate all stored credentials and keys.

The bottom line: MikroTik routers are everywhere on home and small-business networks, and 120,000+ of them were sitting exposed to a full unauthenticated takeover. This chain has been exploited in the wild since early September. Patch RouterOS to 6.49.21, 7.23.4, or 7.24.2 today — and lock down SSH access while you’re in there.