Active MikroTik routers under attack as CERT warns of widespread breach risk

Security researchers warn that malicious actors are exploiting critical flaws in MikroTik RouterOS to take over exposed devices worldwide, urging administrators to urgently patch and review configurations amid active breaches dating back to early September.

Administrators running MikroTik routers with SSH exposed to the public internet are being urged to work on the assumption that those systems may already have been breached, after CERT Polska confirmed that attackers are actively chaining two RouterOS flaws into a takeover technique it calls MikroTrick. CERT says successful intrusions have been traced back to at least 2 September 2026, before its public warning on 5 September, and security researcher Costin Raiu said exposed devices “may already be compromised”. (cert.pl)

CERT Polska says it disclosed six RouterOS vulnerabilities in total, but two critical SSH issues are enough to hand an attacker complete control of a reachable device without prior authentication. CVE-2026-67276, rated 9.2 on the CVSS scale, stems from incomplete RSA public-key validation and can let an attacker log in if they know a username and the modulus of that user’s key. CVE-2026-86060, also rated 9.2, allows privilege escalation through a crafted username, turning that foothold into a full administrator session. CERT also highlighted CVE-2026-67277, an 8.8-severity flaw in the bandwidth-test service that can leak kernel memory or crash and restart a router remotely. (cert.pl)

MikroTik published fixes on 3 September in RouterOS 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21, and CERT says those releases block the attacks it has observed. The vendor has deliberately held back detailed technical information to buy users time to patch, while saying that “most configurations are not at risk” and that the default configuration blocks SSH from the internet unless an administrator has opened it. CERT added that MikroTik also pushed a phone notification to users of its mobile app, an unusual step that underlined the urgency. There is, however, a versioning wrinkle on the long-term branch: CERT and MikroTik identify 7.23.4 as the first fixed build, while The Hacker News noted that users on that channel should move on to 7.23.5, which keeps the security fix while correcting an IPv6 DHCP regression introduced in 7.23.4. (mikrotik.com)

The scale of internet exposure helps explain the concern. Golem, citing Shadowserver scan data, reported that about 122,500 MikroTik routers were reachable worldwide over SSH. Its country breakdown put Brazil first with about 11,300 systems, followed by the United States with 7,100, Indonesia with 6,300 and the Czech Republic with 6,300; Germany accounted for roughly 1,700. Those figures do not show how many routers are still vulnerable or unpatched, but they do show how large the target pool is for opportunistic scanning. (golem.de)

CERT’s indicators of compromise are unusually specific. It says defenders should look for log entries showing “login failure for user -2 from via ssh” and “user added by ssh:-2@”, as well as the presence of a highly privileged account named “ops”. CERT linked confirmed successful attacks, including creation of the ops account, to the IP address 82.192.72.4 and said those attacks date to at least 2 September; it also named 103.102.31.18 as an address seen attempting exploitation. Security Affairs added operational detail from Raiu’s analysis, saying a successful entry may appear in /system history as ssh:-2@ before actions such as adding a user or SSH key, altering firewall rules, or enabling a proxy or tunnel. The same report said 82.192.72.4 was serving a MIPS BusyBox binary and several script files during the campaign. (cert.pl)

For incident response, CERT’s advice is tougher than a simple upgrade. If compromise is suspected, it recommends isolating the router, preserving logs and configuration, factory-resetting the device, rebuilding it from a trusted configuration, and rotating passwords, keys and other secrets. Administrators who cannot patch immediately are being told to disable or tightly restrict external SSH, WWW or WWW-SSL, and bandwidth-test access, and to avoid built-in SSH clients and outbound TLS sessions over untrusted networks from unpatched devices. Both CERT and MikroTik warn that the new “Flagged” status is only a partial detector of known malicious changes: a clean status does not prove a device is clean. Tolmo’s technical write-up adds that RouterOS logs are memory-resident by default, so remote syslog or SIEM records may be more reliable than the device’s own recent history if an attacker has rebooted or edited the box. (cert.pl)

The episode also shows how little time defenders may have once a patch lands. CERT says its researchers used AI assistance in finding the six flaws. Tolmo reported that it reconstructed a working exploit chain from CERT’s public advisory and the patch diff in about three hours, using roughly 110,000 tokens in its main session, although it said four other frontier models failed to produce a complete chain from the same material. That claim is Tolmo’s, not an independent vendor assessment, but it reinforces CERT’s broader warning that attackers were already active before most administrators would have had time to test and deploy updates. (cert.pl)

What is still missing is a victim count or a confirmed attribution. The Hacker News said, as of 6 September, that no public total for affected organisations or users had been established and no attacker had been identified. For now, the practical distinction is simpler: routers still running exposed management services need patching and review, while those already updated still need to be checked for unknown users, scripts, scheduler tasks, proxy settings and tunnels. (thehackernews.com)