Attackers are exploiting MikroTik RouterOS flaws to take full administrative control of routers whose SSH service is exposed to the internet, CERT Polska confirmed in a security warning published September 5. The Polish national incident response team said successful activity has occurred since at least September 2 and urged administrators to install MikroTik's fixed releases immediately. The number of compromised devices and the attackers' identity remain unknown.

CERT Polska discovered six RouterOS vulnerabilities and coordinated their disclosure with MikroTik. The researchers call the two-flaw combination observed in attacks MikroTrick, but neither the warning nor the accompanying disclosure identifies which two bugs form that chain. Independent reporting by The Hacker News on September 6 emphasized that the available dates do not establish whether attackers acted before a public fix, so describing the activity as zero-day exploitation would be unverified.

Two critical SSH issues illustrate the risk. CVE-2026-67276, scored 9.2, results from incomplete verification of RSA public keys and can let an attacker who knows a username and authorized key modulus authenticate without the private key. CVE-2026-86060, also scored 9.2, mishandles a specially formed username and can elevate an unauthenticated SSH session to full RouterOS administrative privileges.

CERT Polska also documented CVE-2026-67277, an 8.8-severity bandwidth-test flaw that can expose kernel memory or remotely restart a device. Three further issues affect SSH rekey handling, X.509 certificate validation and the WebFig interface. The affected ranges are RouterOS 6.0.0 through versions before 6.49.21, 7.0.0 through versions before 7.23.4, and 7.24 before 7.24.2, according to the disclosure.

MikroTik says fixes are included in RouterOS 6.49.21, 7.23.4, 7.24.2 and 7.25beta3. After updating, administrators should review logs and configuration for unknown users, scripts, scheduled tasks, proxy servers and tunnels. CERT Polska identified a highly privileged account named ops and log entries showing account creation by ssh:-2@ as indicators requiring investigation. It attributed confirmed successful activity to 82.192.72.4 and exploitation attempts to 103.102.31.18.

Organizations unable to patch immediately should block SSH, WWW or WWW-SSL and bandwidth-test access from outside trusted management networks. A router showing suspicious artifacts should be isolated while logs and configuration are preserved, then reset and rebuilt from a trusted configuration rather than a potentially compromised backup. CERT Polska also recommends rotating passwords, keys and other secrets, while warning that the absence of RouterOS's Flagged marker does not prove a device is clean.