GoKawiilMikroTik RouterOS SSH flaws chained in active router hijacking attacks
Attackers are combining two newly disclosed MikroTik RouterOS vulnerabilities, an SSH authentication bypass (CVE-2026-67276) and a privilege escalation bug (CVE-2026-86060), to seize full control of routers with SSH exposed to the internet. Poland's CERT, which found the flaws with AI assistance, calls the combined exploit 'MikroTrick' and confirms it is being used in real-world attacks. MikroTik patched the issues in RouterOS versions released September 3, alongside a related bandwidth-test flaw that can leak memory or crash devices.
GoKawiil's interpretation of the reporting above, not reported fact.
Internet-facing SSH on routers is common in small business and ISP deployments, so a working exploit chain that grants full admin access poses a serious risk of mass compromise, botnet recruitment, or network pivoting. The vendor's decision to withhold technical details buys time for patching but also means many exposed devices remain vulnerable until administrators act.
- Two chained CVEs let attackers bypass SSH auth and gain full admin control on MikroTik routers.
- Poland's CERT confirms active exploitation in the wild, naming the attack chain 'MikroTrick'.
- Fixes are available in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21; users should update immediately.
MikroTik hEX S Gigabit Router (RB760iGS) — If you're running older RouterOS hardware, the hEX S is a solid current-generation MikroTik box that runs up-to-date RouterOS firmware you can patch against flaws like the MikroTrick chain. It packs five gigabit ports plus an SFP cage, making it a capable little router for home labs and small offices — just remember to keep SSH off the public internet.
See MikroTik hEX S Gigabit Router (RB760iGS) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-07
Published there as: “Hackers exploit new MikroTik RouterOS flaws to hijack routers”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.