MikroTrick Exploited: 122,500 RouterOS Devices Exposed to SSH Auth Bypass Chain

The MikroTrick attack chain combines two distinct CVSS 9.2 vulnerabilities, each targeting a different failure in RouterOS's SSH implementation.

CVE-2026-67276: Incomplete RSA Key Validation

RouterOS implements SSH public key authentication by checking whether a connecting client's RSA key matches an authorized key stored on the device. The flaw is that RouterOS validates only a partial portion of the RSA public key during the comparison rather than verifying the complete key. An attacker who knows a valid username and the public modulus of that user's RSA key can mathematically construct an alternative RSA key that produces the same partial match RouterOS checks. RouterOS accepts the forged key as valid, authenticating the attacker without the legitimate user's private key. No brute force is required. The attack succeeds in a single SSH connection attempt once a valid username is known.

CVE-2026-86060: Username-Based Privilege Escalation

Once the attacker establishes a low-privilege session via CVE-2026-67276, CVE-2026-86060 escalates it to full administrative access. RouterOS fails to sanitize or reject SSH usernames that begin with a specific disallowed character. A crafted username causes RouterOS's SSH session handler to allocate a session with full administrative privileges. The attacker's initially low-privilege session is upgraded to root without any additional credential check.

CVE-2026-67277: Bandwidth-Test DoS

A third flaw, CVE-2026-67277, affects RouterOS's bandwidth-test service. The service accepts related connections before the primary session completes authentication, allowing an unauthenticated client to leak kernel memory or cause a remote device crash. This flaw does not enable root access but represents a denial-of-service risk on devices with the bandwidth-test service running on TCP port 2000.

All three vulnerabilities were fixed in RouterOS 7.24.2, 7.23.4, and 6.49.21, released September 3, 2026.

All RouterOS builds released before September 3, 2026 are vulnerable to CVE-2026-67276 and CVE-2026-86060. The Shadowserver Foundation found 122,500 RouterOS devices with SSH exposed to the public internet during a 24-hour scan on September 5 -- after patches were released but before most organizations had deployed them. Each of those devices is a target the MikroTrick chain can compromise without any credentials.

Fixed RouterOS versions:

• 7.24.2 (Stable, released September 3, 2026)
• 7.23.4 (Long-term, released September 3, 2026)
• 6.49.21 (Legacy Long-term, released September 3, 2026)
• 7.25beta3 (Testing branch, also patched)

RouterOS is widely deployed across three high-concentration environments. ISPs and telecoms use MikroTik for subscriber management, BGP edge routing, and CGNAT infrastructure -- a compromised ISP router has network-level access to all subscriber traffic. Enterprise branch and SD-WAN edges use RouterOS for site connectivity, giving attackers a trusted network node inside the branch perimeter. Managed service providers manage large RouterOS estates across client sites, where one missed update cycle across a template creates broad exposure.

MikroTik Cloud Hosted Router instances in cloud environments are also affected when running pre-patch builds with SSH accessible from public addresses. Restricting SSH to management IP ranges reduces attack surface but does not eliminate the underlying vulnerability.

The attack requires only TCP/22 to be reachable and a valid username to exist on the device. Many default RouterOS configurations include the 'admin' user, giving attackers a known-valid username without reconnaissance. For organizations managing MikroTik estates, the effective scope is every internet-facing RouterOS device not yet running a September 3 or later build.

See also the N-able N-central CVE-2026-86218 MSP supply chain risk for the parallel pattern of MSP-managed infrastructure targeted via pre-auth RCE.

CERT Polska confirmed exploitation of the MikroTrick chain starting September 2, 2026 -- one day before MikroTik published patches. Attackers operated inside a zero-day window with no public fix available, targeting RouterOS devices via automated SSH scanning.

Two attacker IP addresses are documented in CERT Polska's disclosure:

• 82.192.72.4: Confirmed successful attacks resulting in device compromise
• 103.102.31.18: Documented in exploitation attempts

The primary persistence mechanism is creation of a user account named 'ops' with full administrative privileges. This account is written via the exploit chain using CVE-2026-86060's crafted username to elevate privileges before the account write completes. The name 'ops' blends into router configurations where operator accounts are common in ISP environments.

A secondary log indicator is the appearance of '-2' as an SSH username in RouterOS system logs. This character sequence is the disallowed-prefix value used in CVE-2026-86060 exploitation. RouterOS logs SSH login failures and session creation events with the exact username presented, making log analysis reliable for both attack detection and post-incident investigation.

Specific log patterns to search (CERT Polska):

• login failure for user -2 from <ip> via ssh -- CVE-2026-86060 privilege escalation attempt detected
• user <name> added by ssh:-2@<ip> -- successful account creation via the exploit chain confirmed

No specific threat actor group has been attributed to the September 2 exploitation wave. The attack pattern is consistent with automated scanning infrastructure. Shodan, FOFA, and similar search engines index MikroTik SSH banners, making target identification trivial for any attacker with the exploit.

The following rules detect MikroTrick exploitation attempts and post-exploitation account creation using RouterOS syslog entries forwarded to a SIEM. Both rules carry experimental status. Deploy in alert-only mode first and validate against your RouterOS log baseline before enabling automated response actions. Requires RouterOS syslog forwarding configured under System, Logging, Actions.

Rule 1: MikroTrick SSH Auth Bypass Attempt Detects the '-2' username in RouterOS SSH log entries, the specific indicator of CVE-2026-86060 privilege escalation attempts. Any match represents an active exploitation attempt against this device.

Rule 2: MikroTrick Post-Exploitation Account Creation Detects the 'ops' backdoor account being added via SSH following successful MikroTrick exploitation. A single match on this rule should be treated as a confirmed device compromise requiring immediate incident response.

Apply the patch as the primary action. There are no software workarounds that eliminate CVE-2026-67276 or CVE-2026-86060. Restricting SSH access reduces the attack surface while patching is arranged. Devices that were internet-accessible before patching require credential rotation and forensic log review before returning to service.

MikroTik RouterOS is not an edge case. It is the routing and firewall platform for thousands of ISPs, hundreds of thousands of enterprise branch offices, and millions of small business networks worldwide. When a pre-auth root chain like MikroTrick lands with 122,500 devices reachable from the internet on day one, the math for defenders is unfavorable: attackers had automated tooling, a known target list indexed by Shodan, and a 24-hour zero-day window before any patch existed.

The MikroTrick attack pattern confirms a lesson repeated across Fortinet, Cisco, and Palo Alto perimeter CVEs: the network edge device is not just a tool to protect the network, it is itself a high-value attack target. Compromise of a MikroTik router does not merely give an attacker one device. It gives them a trusted network node that routes, inspects, and forwards traffic for every device behind it. DNS redirection, credential interception, and lateral movement via the router's privileged position are all possible without any additional exploits.

The SSH management plane is the critical lesson here. Unlike web application vulnerabilities where WAF rules can provide interim protection, SSH authentication bypasses have no HTTP-layer mitigation path. CVE-2026-67276 fails at the cryptographic comparison level, not at the payload content level. The only effective controls are patching and SSH access restriction. Any organization that exposes router SSH management interfaces to the public internet is trading the convenience of remote access for unrestricted attacker access when a flaw like CVE-2026-67276 lands.

For teams managing MikroTik estates, the operational takeaway is to treat RouterOS firmware updates with the same urgency applied to internet-facing servers. A perimeter router running outdated firmware is not a low-risk system. It is the first and most trusted node attackers want to control.

See also the Cisco FMC CVE-2026-20079 pre-auth root RCE and the WatchGuard Firebox CVE-2025-14733 ransomware exploitation for closely related perimeter appliance compromise patterns from the same period.