MikroTik RouterOS Under Attack: Critical SSH Vulnerabilities Enable Router Takeover

Summary

MikroTik RouterOS is currently under active exploitation following the disclosure of six vulnerabilities affecting its SSH services, bandwidth-test functionality, X.509 certificate handling, and WebFig interface. The vulnerabilities can lead to authentication bypass, privilege escalation, sensitive information disclosure, denial of service, TLS server impersonation, and unauthorized file access.

The most serious attack scenario involves chaining CVE-2026-67276 and CVE-2026-86060. CVE-2026-67276 is an SSH authentication bypass caused by incomplete RSA public-key verification. An attacker who knows the username and public RSA modulus associated with an authorized key can construct a malicious key and authenticate without possessing the legitimate private key. CVE-2026-86060 can then be used to manipulate the SSH login process and obtain a session with full administrative privileges.

This attack chain, referred to as MikroTrick, can therefore allow an unauthenticated remote attacker to take complete control of a vulnerable MikroTik router when SSH is accessible from the Internet. Active exploitation of the chain has been confirmed against publicly reachable RouterOS devices since at least September 2, 2026.

The remaining vulnerabilities further increase the attack surface. CVE-2026-67277 can expose uninitialized kernel memory or cause a RouterOS system restart through the bandwidth-test service. CVE-2026-67278 can allow TLS server impersonation through improper RSA signature validation. CVE-2026-67279 allows unauthenticated file manipulation through an SSH state-machine flaw, while CVE-2026-67281 can allow unauthenticated attackers to read protected files through WebFig.

MikroTik has released fixes for the affected branches. Administrators should immediately update vulnerable devices and verify that SSH and other management services are not exposed to untrusted networks.

Background

MikroTik RouterOS is the operating system used by MikroTik routers and networking appliances. It provides routing, firewalling, VPN, wireless networking, bandwidth management, user administration, SSH-based management, WebFig administration, and other network-management capabilities.

The September 2026 vulnerability disclosure identified six security issues across several RouterOS components. The most significant risk comes from the SSH attack chain, where two vulnerabilities can be combined to bypass authentication and obtain administrative privileges.

The issue is particularly dangerous for routers that expose SSH directly to the Internet. MikroTik states that its default configuration does not expose SSH to the Internet, but administrators who manually opened management access should restrict it to trusted networks or use a VPN such as WireGuard.

Vulnerability Details

CVE ID	Severity	CVSS	EPSS	Vulnerability Type
CVE-2026-67276	Critical	9.2	0.25%	Improper Verification of Cryptographic Signature
CVE-2026-86060	Critical	9.2	0.40%	Argument Injection
CVE-2026-67277	High	8.8	0.43%	Missing Authentication for Critical Function
CVE-2026-67281	High	8.7	0.46%	Access of Uninitialized Pointer
CVE-2026-67279	Medium	6.9	0.45%	Improper Enforcement of Behavioral Workflow
CVE-2026-67278	Medium	6.3	0.17%	Improper Verification of Cryptographic Signature

The six vulnerabilities affect different RouterOS components and version branches. The most critical vulnerabilities for remote router takeover are CVE-2026-67276 and CVE-2026-86060.

Technical Detail

1. SSH Authentication Bypass — CVE-2026-67276

CVE-2026-67276 is a flaw in RouterOS SSH public-key authentication. When matching an incoming authentication request with an authorized RSA public key, RouterOS does not correctly compare the complete public key. The implementation verifies the key type and modulus but fails to properly validate the RSA exponent.

An attacker who knows the username and public RSA modulus of an authorized user can construct a different RSA public key and generate a signature that RouterOS incorrectly accepts. This allows the attacker to establish an SSH command channel as the targeted user without possessing the legitimate private key.

This vulnerability is one of the two vulnerabilities used in the observed MikroTrick attack chain.

2. SSH Privilege Manipulation — CVE-2026-86060

CVE-2026-86060 is an argument-handling vulnerability in the RouterOS SSH login mechanism. Specially crafted usernames beginning with a prohibited character can reach the RouterOS login helper in an unintended way.

An attacker can abuse this behavior to manipulate the trusted policy mask and elevate the privileges of the resulting SSH session. The resulting session can have full administrative privileges within RouterOS.

When combined with CVE-2026-67276, this vulnerability turns the SSH authentication bypass into a complete router takeover.

3. Bandwidth-Test Memory Disclosure and DoS — CVE-2026-67277

CVE-2026-67277 affects the RouterOS bandwidth-test service. A related bandwidth-test connection can be accepted before the corresponding primary connection has completed authentication.

This allows an unauthenticated client to reach functionality that should only be available after authentication. Under specific conditions, the service can disclose uninitialized data from a kernel packet buffer. A separate packet-size validation issue can also cause an integer underflow, resulting in abnormally large fragmented output and potentially restarting the RouterOS kernel.

The vulnerability therefore creates both kernel memory disclosure and remote denial-of-service risks.

4. TLS Server Impersonation — CVE-2026-67278

CVE-2026-67278 affects RSA/PKCS#1 v1.5 signature validation during X.509 certificate processing. RouterOS can accept malformed RSA signatures under specific conditions.

Because the RouterOS trust store contains an RSA root certificate using a small public exponent, an attacker who can control or redirect an outbound TLS connection can potentially construct a forged trusted certificate chain. This can allow the attacker to impersonate a TLS-protected server to the vulnerable RouterOS device.

5. SSH Pre-Authentication State Bypass — CVE-2026-67279

CVE-2026-67279 is a state-machine flaw in the RouterOS SSH implementation. After a client-requested rekey, RouterOS can incorrectly enter the connection protocol even though the user has not successfully authenticated.

An unauthenticated attacker can use this behavior to open a session channel and issue an exec request. On vulnerable versions, this can enable creation, modification, or reconstruction of files within the RouterOS-managed file namespace, including files containing configuration and diagnostic information.

6. Unauthenticated WebFig File Read — CVE-2026-67281

CVE-2026-67281 affects the WebFig /jsproxy functionality. A newly created session can retain an uninitialized authorization pointer that is later used when checking file-access permissions.

By carefully manipulating the memory allocation state and supplying specially crafted paths, an unauthenticated attacker can escape the intended WebFig file namespace and read protected files. This can include root-owned files and configuration stores containing sensitive information such as credentials.

MicroTrick Attack Flow

Indicators of Compromise (IOCs)

Router OS log

• login failure for user -2 from <ip> via ssh
• user <name> added by ssh:-2@<ip>
• An unexpected highly privileged account named ops

Domain and IPs:

• •82.192[.]72.4
• •103.102[.]31.18

Affected Versions and Patch Status

RouterOS Branch	Affected Versions	Fixed Version
RouterOS 6	From 6.0.0 below 6.49.21	6.49.21
RouterOS 7	From 7.0.0 below 7.23.4	7.23.4
RouterOS 7	From 7.24 below 7.24.2	7.24.2>
RouterOS Development	Affected development releases	7.25beta3

The fixed releases published by MikroTik are 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21. MikroTik describes the issue as an important security update and recommends upgrading through the RouterOS update mechanism.

For the 7.23 long-term branch, administrators should use the latest supported release available through MikroTik rather than intentionally remaining on an older fixed build.

Impact

1. Complete router takeover: The CVE-2026-67276 and CVE-2026-86060 attack chain can provide an attacker with full administrative control of a vulnerable router.
2. Unauthorized SSH access: CVE-2026-67276 can allow authentication as an authorized RouterOS user without the corresponding private key.
3. Privilege escalation: CVE-2026-86060 can elevate an SSH session to full administrative privileges.
4. Information disclosure: CVE-2026-67277 can expose kernel memory, while CVE-2026-67281 can expose protected files and potentially sensitive configuration information.
5. Configuration manipulation: CVE-2026-67279 can allow unauthorized creation or modification of RouterOS-managed files.
6. Denial of service: CVE-2026-67277 can potentially trigger a RouterOS kernel restart.
7. TLS impersonation: CVE-2026-67278 can allow an attacker meeting the required network conditions to impersonate trusted TLS servers.
8. Network infrastructure compromise: Full administrative access to a router can allow attackers to modify routing, firewall, VPN, DNS, proxy, and other network configurations.

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic	Relevance
T1190	Exploit Public-Facing Application	Initial Access	Attackers can exploit Internet-accessible RouterOS management services, particularly SSH, to gain initial access.
T1078	Valid Accounts	Defense Evasion / Persistence / Privilege Escalation	CVE-2026-67276 can cause the attacker to obtain an SSH session in the context of an existing RouterOS account without possessing the legitimate private key.
T1068	Exploitation for Privilege Escalation	Privilege Escalation	CVE-2026-86060 can be exploited to manipulate the SSH login process and obtain elevated RouterOS privileges.
T1083	File and Directory Discovery	Discovery	CVE-2026-67281 and CVE-2026-67279 can provide unauthorized access to RouterOS-managed files and configuration information.
T1005	Data from Local System	Collection	The WebFig file-read vulnerability can expose sensitive files stored on the RouterOS device.
T1562.004	Disable or Modify System Firewall	Defense Evasion	Administrative access to RouterOS can allow an attacker to modify firewall and network-security controls. This represents potential post-compromise activity rather than a behavior explicitly confirmed for every observed attack.

Mitigation

1. 1. Update RouterOS immediately. Upgrade affected devices to the appropriate fixed and currently supported RouterOS release. MikroTik has released fixes in 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21.
2. 2. Restrict SSH access. Do not expose SSH to untrusted networks. If remote management is required, restrict access to trusted IP addresses or use a VPN such as WireGuard.
3. 3. Review other exposed services. Restrict Internet access to RouterOS management interfaces such as WebFig and other administrative services that are not required to be publicly reachable.
4. 4. Check RouterOS logs. Search for suspicious entries involving user -2, ssh:-2@, unexpected account creation, and other abnormal SSH activity.
5. 5. Inspect the configuration. Look for unknown users, scripts, scheduler tasks, proxy servers, tunnels, firewall rules, and other unexplained configuration changes.
6. 6. Check the Flagged status. Fixed RouterOS versions can identify certain known traces of compromise and mark the device as Flagged. However, the absence of the Flagged marker does not prove that a device is clean.
7. 7. Preserve evidence. If compromise is suspected, isolate the device and preserve logs and configuration information before making significant changes.
8. 8. Rebuild compromised devices. A device confirmed or strongly suspected to be compromised should be restored to a trusted state and reconfigured rather than blindly restoring a potentially compromised backup.
9. 9. Rotate credentials and keys. Change passwords, SSH keys, and other secrets that may have been exposed on a compromised device.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.