MikroTik RouterOS SSH Bypass Exploited in the Wild; SANS Says Assume Compromise

Attackers are taking over MikroTik routers that have SSH reachable from the internet, and they are doing it with no password at all. On September 5, Poland’s national CSIRT, CERT Polska, confirmed that a two-vulnerability chain it calls MikroTrick is being used in the wild to gain full administrative control without authentication on any RouterOS device whose SSH service is exposed to public networks. The Shadowserver Foundation counted at least 122,500 MikroTik devices with SSH reachable in a single 24-hour scan window on September 5, a figure that measures exposure, not confirmed compromise.

The uncomfortable part is the timing. CERT Polska traced confirmed attacks to at least September 2, a day before MikroTik quietly shipped patched builds on September 3 and three days before the public advisory landed. That ordering is why the SANS Internet Storm Center boiled its guidance down to two words: “assume compromise.” A patched box is not automatically a clean box, because the intruders have been adding their own accounts to survive the update. If you run a MikroTik router with internet-exposed SSH, the patch is step one of the job, not the end of it.

What CERT Polska Found

CERT Polska discovered six flaws in RouterOS and coordinated their disclosure with MikroTik; two of them combine into the credential-free takeover. The team, which said it found the bugs with help from OpenAI models under a government collaboration program, published on an accelerated schedule because the fixed packages were already public and could be reverse-engineered.

The anchor of the chain is CVE-2026-67276 (CVSS 9.2), an SSH authentication bypass. Per CERT Polska and Help Net Security, RouterOS compared only the public modulus of a user’s RSA key rather than the full key when matching an SSH login, so an attacker who knew a valid username and its modulus could present a different key and log in without ever holding the private key. The second link, CVE-2026-86060 (also CVSS 9.2), is a privilege-escalation flaw in how RouterOS handled SSH usernames that began with a disallowed character, letting an attacker craft a username that returned a session with full administrative rights. Chained, the two turn an exposed SSH port into root of the device.

A third flaw, CVE-2026-67277 (CVSS 8.8), sits in the bandwidth-test service and, combined with a memory leak and an integer underflow, could expose kernel memory or crash the device, per Help Net Security. Three lower-severity issues affect the SSH client, X.509 certificate handling, and the WebFig interface. In its advisory, CERT Polska said it had “obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks.”

Why “Assume Compromise” Is the Right Posture

Assume compromise because the patch closes the door but does not evict anyone already inside. SANS framed it plainly: MikroTik shipped a fix for a bug that was already being exploited, and, as SANS put it, “at this point, assume compromise.” The attackers observed by CERT Polska were not just proving the exploit worked. They were establishing persistence, creating new accounts so a later upgrade would not lock them out.

MikroTik built a partial safety net into the fixed builds. Per MikroTik’s security bulletin, patched RouterOS scans the configuration at startup for known signs of tampering, disables entries it recognizes as suspicious, writes a log message, and sets a “Flagged” marker. That is useful, but it only catches what MikroTik already knows to look for. The vendor itself tells administrators not to trust a clean result: “Even if your device is not in Flagged state, after upgrading your RouterOS, inspect your device configuration for any unknown scripts, users or other config you do not recognise.” In other words, the automated check is a floor, not a ceiling, and the manual hunt is still on you.

Operator response for internet-exposed MikroTik RouterOS devices. Source: CERT Polska and MikroTik, September 2026.

How to Tell If You Are Already Owned

The clearest tell is an account you did not create. CERT Polska, as relayed by The Hacker News and Help Net Security, listed a specific set of indicators from the confirmed attacks: log entries reading “login failure for user -2 from via ssh” and “user added by ssh:-2@”, and the appearance of a highly privileged user named “ops” with no legitimate explanation. Investigators tied the successful intrusions, including creation of that “ops” account, to the IP address 82.192.72.4, active since at least September 2, and flagged a second address, 103.102.31.18, used in attempts against the same chain.

Run /system/device-mode/print and check the Flagged status, then read the logs for the strings above. But treat a quiet log as inconclusive, not exonerating: the hunt for unknown users, scripts, and scheduler entries is the part that actually clears the device. If you find evidence of compromise, CERT Polska’s recovery order matters. Isolate the router and preserve its logs and configuration for evidence before you reset anything, restore to factory settings, rebuild from a trusted configuration rather than a full backup of the suspect box, and rotate every password, key, and secret it touched.

What to Patch, and to What

Fixed builds exist for every supported channel, so match your version and upgrade. MikroTik and CERT Polska list the following, per Help Net Security and The Hacker News’s September 6 cross-check of the two advisories:

One caveat for long-term users: The Hacker News notes that 7.23.5 fixes an IPv6 DHCP regression introduced in 7.23.4 while keeping the security patch, so it is the better target on that channel. Patch prioritization like this is exactly the muscle a mature vulnerability management program is built to exercise, and an exposed edge device with a public CVSS 9.2 belongs at the top of the queue.

The Recurring Own-Goal

My read: internet-exposed router management is the own-goal that keeps scoring against defenders, and assume-compromise is the correct posture precisely because a patched box may already be owned. This is reported as an active-exploitation event; the assessment that follows is mine. The MikroTrick chain is clever, but it needed one precondition that no vendor patch can guarantee away: an SSH service answering the whole internet. Shadowserver found six figures of MikroTik devices in that state before anyone checked whether they were vulnerable. The same shape shows up again and again on edge gear, from the allied warning about Russian state actors targeting critical-infrastructure routers to Tropic Trooper’s router-borne intrusions into Japanese networks. Routers are quiet, rarely logged into, and often forgotten, which is exactly why they make durable footholds.

So the defender takeaway is not just “patch,” even though you should, today. It is to treat every internet-facing management plane as a liability to be closed, and to run the assume-compromise incident-response hunt on any box that was exposed, whether or not RouterOS raises a flag. As of publication, neither the number of confirmed compromised devices nor the identity of the attackers has been established, and the two flaws had not yet appeared in CISA’s Known Exploited Vulnerabilities catalog. None of that changes the posture. CERT Polska’s operational confirmation is enough.

Updated September 6, 2026: this is a developing story and will be updated as CERT Polska, MikroTik, or CISA release further detail.

Primary documents

• CERT Polska: Vulnerabilities in MikroTik RouterOS actively exploited
• CERT Polska: affected RouterOS versions and CVE list
• MikroTik: September 2026 security bulletin
• SANS Internet Storm Center diary: MikroTik RouterOS, assume compromise
• NVD: CVE-2026-67276 and CVE.org: CVE-2026-86060