A chain of critical vulnerabilities in MikroTik RouterOS lets attackers seize full administrative control of routers with SSH exposed to the Internet, without holding the user’s valid private credentials. CERT Polska has dubbed the attack MikroTrick and confirms it is already being actively exploited. The issue combines a flaw in RSA key validation with a second privilege-escalation vulnerability, so administrators should update RouterOS and check for potentially exposed devices.
MikroTrick in 20 seconds
- MikroTrick combines CVE-2026-67276 and CVE-2026-86060, both critical.
- The first vulnerability allows bypassing SSH authentication with certain RSA keys.
- The second can turn that session into full administrative access.
- Attacks have been observed since at least September 2, 2026.
- Administrators should update RouterOS and look for indicators such as
-2and theopsaccount.
The risk is especially high for routers whose SSH service can be reached directly from the Internet or from networks that shouldn’t have access to the management plane. A MikroTik router protected by firewall rules that limit SSH to a specific management network has a much smaller attack surface, although updating is still recommended.
The significance of the incident is that the attack is no longer purely theoretical. CERT Polska has confirmed real-world exploitation, and there are activity logs that predate the release of the patches, which has led some to treat the chain as a zero-day case.
CVE-2026-67276 Breaks RSA-Based SSH Authentication
The first component of MikroTrick is CVE-2026-67276, with a CVSS score of 9.2.
The flaw lies in how RouterOS verifies certain RSA public keys during an SSH connection. In a properly implemented authentication scheme, the server shouldn’t simply check that a public key matches the one configured for the user — it must also cryptographically verify that the client actually holds the corresponding private key.
According to the technical analysis published on the vulnerability, RouterOS was not correctly validating all the parameters involved in that check.
The described scenario requires the attacker to know:
- a valid username;
- public information tied to that user’s authorized RSA key;
- network access to the router’s SSH service.
With those elements, an attacker can build a manipulated key that passes the check performed by RouterOS without ever holding the original private key.
The result is an SSH authentication bypass.
That doesn’t mean any anonymous connection can simply walk in by sending an empty password. The vulnerability depends on the flawed RSA validation behavior and on having certain public data associated with the targeted user.
| Vulnerability | Component | Result |
|---|---|---|
| CVE-2026-67276 | RSA validation in SSH | Authentication bypass |
| CVE-2026-86060 | Privilege handling in the SSH session | Privilege escalation |
| MikroTrick | Combination of both | Administrative control |
The second piece, CVE-2026-86060, allows the attacker to escalate the privileges initially obtained.
Once both flaws are chained, a session created through the first vulnerability can end up with enough privileges to modify practically the entire router configuration.
That opens the door to creating additional users, adding SSH keys, modifying the firewall, installing scripts, enabling proxies, configuring tunnels, or rerouting traffic.
Attacks Leave Unusual Traces on RouterOS
One of the most useful things for security teams is that the exploitation observed so far can leave relatively recognizable indicators.
Among them is an anomalous user:
-2
A failed attempt may be logged with an entry similar to:
login failure for user -2 from <IP> via ssh
In other cases, a change may appear inside /system history tied to a session such as:
ssh:-2@<IP>
The value -2 doesn’t correspond to a conventional account an administrator would expect to find on a normal RouterOS installation.
Its appearance, especially alongside configuration changes, should be treated as an indicator that calls for immediate investigation.
Confirmed attacks have also included the creation of an account named:
ops
Even so, it isn’t enough to search only for those two names and assume a router is clean if they don’t show up.
Logs may have rotated, been deleted, or no longer hold the entries from the time of the intrusion. That’s why the review should extend to the entire system configuration.
Elements worth inspecting include:
/user, to spot unknown accounts;- SSH keys tied to users;
- scripts and schedulers;
- new or modified firewall rules;
- recently enabled services;
- proxies and tunnels;
- sniffing configuration;
- unexpected routing changes;
- persistent configurations that could let the attacker regain access later.
The addresses 82.192.72[.]4 and 103.102.31[.]18 have also been linked to the campaign.
The first is also reported to have hosted several files used during the observed activity, including ftpsrv.py, launch.sh, and serve.py.
These indicators can help with historical searches across logs, SIEMs, and monitoring systems, but they shouldn’t be used as the sole criterion to rule out a compromise.
Which Versions Fix MikroTrick, and What to Do After Updating
MikroTik released the fixes in early September.
The branches that should be used as a minimum reference are:
| Branch | Fixed version |
|---|---|
| RouterOS 7.24 | 7.24.2 |
| RouterOS 7.23 | 7.23.4 or later |
| RouterOS 6.x | 6.49.21 |
| Beta | 7.25beta3 |
RouterOS 7.23.5, released afterward, also contains the corresponding fixes.
For an administrator keeping SSH publicly accessible, the priority should be updating to a fixed version or a later one compatible with the device.
But the patch only fixes the vulnerability. It doesn’t automatically remove any persistence an attacker may have set up before the update.
A router that was already compromised could remain under the attacker’s control even after the original vulnerability stops being exploitable.
For that reason, when there’s evidence of intrusion, the response should be broader:
- Isolate the device from untrusted networks.
- Preserve logs and configuration if forensic analysis is needed.
- Review users, keys, scripts, rules, and services.
- Change any credentials and secrets that may have been exposed.
- Reset the router to factory defaults when a compromise is confirmed.
- Rebuild the configuration from a known, trustworthy source.
- Then apply the latest RouterOS updates.
Automatically restoring a full backup of the compromised router itself can be dangerous if that backup already contains users, scripts, or changes introduced by the attacker.
Until the update can be applied, the immediate mitigation is to remove SSH access from the Internet and limit it strictly to controlled administrative addresses or networks — the same kind of segmentation that limits blast radius after other recent authentication-bypass vulnerabilities affecting exposed management interfaces.
The same applies to other unnecessarily exposed administrative services, including WWW/WWW-SSL and features such as bandwidth-test.
From an architectural standpoint, the incident once again shows the risk of directly exposing infrastructure management interfaces.
SSH is a protocol designed for secure remote administration, but that doesn’t automatically make any SSH service reachable from the whole Internet safe. A pre-authentication vulnerability can wipe out, in one stroke, the guarantees offered by strong passwords or cryptographic keys.
Restricting the management plane through VPNs, access control lists, firewalls, and separate networks considerably reduces exposure even when a critical software flaw shows up.
MikroTrick is especially concerning because it combines exactly the two capabilities an attacker looks for in a perimeter device: entry without valid authentication and escalation to full administration.
And a compromised router sits in a privileged position on a network. It can observe traffic, redirect connections, modify DNS, create tunnels to external infrastructure, or become an entry point into other internal systems.
That’s why, in this case, updating RouterOS should only be the first part of the response. The second is finding out whether someone got there first.
Frequently Asked Questions
What is MikroTrick?
MikroTrick is the attack chain identified by CERT Polska that combines CVE-2026-67276 and CVE-2026-86060. Together, they let an attacker bypass SSH authentication and gain administrative privileges on RouterOS.
Which MikroTik routers are most exposed?
Devices with SSH directly reachable from the Internet or from untrusted networks carry the highest risk. Equipment whose firewall limits administrative access to a specific network considerably reduces the attack surface.
What does finding ssh:-2 in RouterOS mean?
The identifier -2 has been observed during MikroTrick exploitation. If it shows up alongside changes to users, keys, firewall rules, scripts, tunnels, or other administrative actions, the device should be treated as potentially compromised.
Is updating to RouterOS 7.24.2 enough?
The update fixes the known vulnerability, but it doesn’t undo any changes an attacker may have made beforehand. If there’s evidence of compromise, the configuration needs to be reviewed, and a full reset of the device should be considered.