Poland’s national computer emergency team CERT Polska is warning about an actively exploited attack chain dubbed “MikroTrick” that lets intruders seize full control of MikroTik routers running the RouterOS operating system without any valid credentials. Devices whose SSH service is reachable from the public internet are at risk.
Two flaws form the chain
On 5 September 2026, CERT Polska disclosed six RouterOS vulnerabilities in total. Two of them combine into “MikroTrick”: CVE-2026-67276 (CVSS 9.2) is an authentication bypass. When matching an SSH key, RouterOS does not compare the complete RSA public key but checks only the key type and modulus while ignoring the exponent. An attacker who knows an authorized modulus can supply a key with exponent 1, forge a valid signature, and log in as a legitimate user without ever holding the private key.
The second bug, CVE-2026-86060, escalates that foothold to root: usernames beginning with a prohibited character can be used to alter the RouterOS policy mask, turning a foot in the door into full administrative control.
Exploited before the patch
According to CERT Polska, exploitation began as early as 2 September, one day before MikroTik shipped fixed RouterOS builds on 3 September. A telltale sign of compromise is an unusual SSH user starting with a forbidden character, such as “-2”, appearing in the logs.
- Fixed in RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
- Block internet-facing SSH access or restrict it to fixed IP addresses
- Audit accounts and firewall rules for suspicious changes
MikroTik gear is widely deployed in Germany among smaller providers, businesses and home labs. Administrators should update affected routers immediately and lock down SSH exposure.
Sources: CERT Polska · BleepingComputer · Help Net Security
