Loading story…
Active exploitation of the MikroTrick vulnerability chain is allowing attackers to take over internet-exposed MikroTik RouterOS devices without credentials. The attack combines an SSH rekeying authentication-state bypass—reported as CVE-2026-67279 (though one advisory lists CVE-2026-67277)—with CVE-2026-86060, in which a crafted username can make the RouterOS login helper accept an attacker-controlled privileged identity. Researchers reproduced full administrative compromise on vulnerable RouterOS 7.x systems, enabling access-control bypass, persistence, and potential lateral movement into connected networks; CISA has added the flaws to its Known Exploited Vulnerabilities catalog.
MikroTik has issued fixes in RouterOS 6.49.21, 7.23.4, 7.24.2, and subsequent applicable releases. Organizations should immediately patch exposed routers, restrict external exposure of Winbox and API services, and audit administrator accounts. They should also investigate devices for attacker-created privileged accounts, scripts, and scheduled tasks, because patching alone will not remove persistence or rotate credentials that may have been exposed during compromise.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
CERT Polska published an advisory covering six MikroTik RouterOS vulnerabilities that could be combined into the MikroTrick takeover chain. MikroTik addressed the issues in RouterOS 6.49.21, 7.23.4, 7.24.2, and later applicable releases.
CERT.UG/CC warned that the active MikroTrick campaign could enable unauthenticated device takeover, persistence, and lateral movement from compromised routers. It urged administrators to update RouterOS, restrict untrusted Winbox and API access, and audit administrator accounts.
During authorized testing, Bishop Fox observed internet-facing MikroTik routers with artifacts consistent with the campaign, including privileged accounts, a logrotate script, and a daily-maint scheduler that recreated a full-privilege account. The observed scripts and scheduler objects used a numeric owner value of "0," though the researchers noted this is only a hunting lead.
Bishop Fox reproduced unauthenticated administrative compromise of vulnerable RouterOS 7.x systems using CVE-2026-67279's SSH rekeying authentication-state bypass and CVE-2026-86060's crafted-username flaw. Its detector was validated as vulnerable on RouterOS 6.49.20 and 7.23.3 and fixed on 6.49.21 and 7.23.4.
CISA added the RouterOS vulnerabilities identified as CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities catalog, with a September 13, 2026 remediation deadline for U.S. federal agencies.
Evidence cited by Bishop Fox indicates that attackers exploited vulnerable internet-exposed MikroTik RouterOS devices before the underlying vulnerabilities were publicly disclosed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
bishopfox.com
Open sourcecert.ug
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MikroTik patched six vulnerabilities in RouterOS releases earlier than `6.49.21`, `7.23.4`, and `7.24.2`. CERT Polska reported flaws affecting SSH authentication and RSA signature validation, WebFig file access, the `btest` service, and SSH login privilege handling. The issues can permit unauthenticated remote SSH command execution, disclosure of root-owned files that may contain credentials, kernel restarts, privilege escalation, and TLS server impersonation. Organizations running affected RouterOS branches should upgrade immediately to RouterOS `6.49.21` (Long-term), `7.23.4` (Long-term), or `7.24.2` (Stable). Administrators should review RouterOS flagged status and logs for compromise evidence, and investigate unauthorized accounts, scripts, scheduled tasks, firewall, VPN, DNS, NAT, and other configuration changes, particularly on internet-exposed devices.
Sep 11, 2026
MBSD-SOC reported a renewed rise in attack traffic targeting **MikroTik RouterOS** devices vulnerable to `CVE-2018-14847`, a **WinBox directory traversal flaw** affecting versions `6.42` and earlier. The vulnerability allows unauthenticated attackers to read arbitrary files and authenticated attackers to write arbitrary files, and observed activity in August appeared aimed at retrieving the router user database through path traversal. MBSD-SOC said detections had previously spiked in April and May 2022, later declined, and then increased again from mid-August. The campaign largely originated from **Germany**, which accounted for **99.7%** of observed detections, while **Japan** represented **0.3%**. Public exploit and proof-of-concept details for `CVE-2018-14847` have long been available, increasing the risk to organizations still running unpatched RouterOS systems. Defenders were urged to update affected devices to the latest RouterOS release, while also noting the separate severe RouterOS issue `CVE-2023-30799` disclosed later.
Aug 15, 2026
MikroTik RouterOS and Cloud Hosted Router were disclosed with **CVE-2026-16347**, a high-severity authentication weakness that allows excessive login attempts because the API lacks effective brute-force protections. The advisory says fixed per-connection delays can be bypassed through concurrent sessions, leaving administrative interfaces exposed to credential guessing across affected versions. Recommended mitigations include applying vendor updates, enforcing stronger rate limiting and account lockout, and restricting access by source IP. A separate disclosure from SBA Research said **DFIR-IRIS 2.4.26**, and possibly other versions, also lacks meaningful brute-force defenses on both password authentication and MFA OTP validation, tracked as **CVE-2026-16971** and **CVE-2026-18362**. Researchers reported no observable rate limiting, delay, or lockout on either endpoint, allowing rapid submission of the full 6-digit OTP space and undermining MFA protections; no vendor fix was available at disclosure. The flaws align with established guidance from **CWE-770** and OWASP API Security on unrestricted resource use and missing throttling, which recommend hard limits, quotas, and rate controls to prevent abuse.
Jul 30, 2026