GoKawiilHackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet.
One of the security issues, tracked as CVE-2026-67276, is an SSH authentication bypass flaw in MikroTik RouterOS caused by incomplete validation of RSA public keys.
An attacker who knows a username and the public modulus of that user’s key can exploit it by crafting a different key and logging in without the legitimate private key.
The second security issue is identified as CVE-2026-86060. It is an SSH privilege escalation flaw in MikroTik RouterOS due to improper handling of specially crafted usernames.
Hackers can leverage it using a specially crafted username to manipulate the SSH session so that the attacker obtains full administrative privileges.
Both vulnerabilities were discovered by Poland's CERT agency with the help of GPT-5.5-cyber and GPT-5.6-sol and received a critical severity rating.
The Polish agency dubbed the exploit chain “MikroTrick,” and warned that it is now actively exploited in the wild.
“In recent days we have been observing attacks against RouterOS devices accessible from the internet,” Poland's CERT warns.
“We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks.”
The Polish CERT also highlighted a third flaw, CVE-2026-67277, which affects the RouterOS bandwidth-test service and allows unauthenticated attackers to leak kernel memory or to remotely crash/restart the router.
... continue reading