Overview
- Poland’s CERT Polska says the two-flaw chain called MikroTrick has been used in the wild since Wednesday, September 2 to gain full administrative control of RouterOS devices that expose SSH to the internet.
- The chain combines CVE-2026-67276, an RSA public‑key authentication bypass that accepts forged keys, and CVE-2026-86060, an SSH username handling bug that elevates the session to administrator privileges.
- MikroTik has published and CERT Polska has validated patches that fix the flaws (notable releases include RouterOS 7.24.2, 7.23.5/7.23.4, 7.25beta3 and 6.49.21) and added a startup 'Flagged' check to disable known malicious entries.
- CERT and researchers published clear indicators of compromise to hunt attacks, including log lines showing login failures for user “-2”, entries like ssh:-2@ creating users, a sudden privileged “ops” account and attacker IPs such as 82.192.72.4, and they urge isolating, preserving logs and factory‑resetting confirmed victims.
- The attack surface is large — ShadowServer counted about 122,500 MikroTik devices with exposed SSH on September 5 — and compromised edge routers can alter DNS, tunnel or capture traffic, change firewall rules and give attackers persistent access to internal networks.