Loading story…
CERT Polska disclosed MikroTrick, an exploit chain combining CVE-2026-67279, an SSH rekey state-machine flaw, with CVE-2026-86060, an argument-injection vulnerability in RouterOS SSH login handling. The chain provides unauthenticated access to the full administrative console on affected MikroTik devices. MikroTik issued fixes in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, initially without detailed vulnerability information.
Evidence indicates exploitation began before patches were available. Activity linked to 82.192.72.4 attempted authentication using the username -2, created a privileged ops account, and likely exfiltrated diagnostic files. CISA added CVE-2026-86060 and related RouterOS SSH issue CVE-2026-67277 to its Known Exploited Vulnerabilities Catalog with a three-day remediation deadline. Organizations should urgently upgrade exposed RouterOS devices, investigate for unauthorized accounts and suspicious SSH activity, and assess potential data exposure.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities Catalog and set a three-day remediation deadline.
CERT Polska began publishing CVE records for CVE-2026-67276 and CVE-2026-86060. CVE-2026-67276 was described as a separate RSA-key authentication impersonation flaw rather than part of MikroTrick.
MikroTik released security updates for RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. The vendor initially described them as important security updates without disclosing vulnerability details, to allow administrators time to patch.
The earliest publicly available attack logs, dated 2 September, showed SSH activity associated with 82.192.72.4, attempted use of the "-2" username, and creation of a privileged "ops" account. Reports also indicated attackers could create administrative accounts on devices using SSH-key-only authentication and strong cryptography, with probable diagnostic-file exfiltration to the same IP address.
MikroTik added a startup detection rule that disables an "ops" account in the privileged "full" group, logs a warning, and marks the device as Flagged. The rule aligns with attack reports involving malicious privileged ops accounts.
CERT Polska reported CVE-2026-86060 to MikroTik through coordinated vulnerability disclosure and provided vulnerability details and a working proof of concept.
CERT Polska identified CVE-2026-86060 as an SSH login argument-injection flaw and showed it could be chained with the CVE-2026-67279 SSH rekey state-machine flaw. The combined chain, named MikroTrick, enables unauthenticated full administrative console access on vulnerable RouterOS devices.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecert.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Active exploitation of the **MikroTrick** vulnerability chain is allowing attackers to take over internet-exposed MikroTik RouterOS devices without credentials. The attack combines an SSH rekeying authentication-state bypass—reported as `CVE-2026-67279` (though one advisory lists `CVE-2026-67277`)—with `CVE-2026-86060`, in which a crafted username can make the RouterOS login helper accept an attacker-controlled privileged identity. Researchers reproduced full administrative compromise on vulnerable RouterOS 7.x systems, enabling access-control bypass, persistence, and potential lateral movement into connected networks; CISA has added the flaws to its Known Exploited Vulnerabilities catalog. MikroTik has issued fixes in RouterOS `6.49.21`, `7.23.4`, `7.24.2`, and subsequent applicable releases. Organizations should immediately patch exposed routers, restrict external exposure of Winbox and API services, and audit administrator accounts. They should also investigate devices for attacker-created privileged accounts, scripts, and scheduled tasks, because patching alone will not remove persistence or rotate credentials that may have been exposed during compromise.
Sep 18, 2026
MikroTik patched six vulnerabilities in RouterOS releases earlier than `6.49.21`, `7.23.4`, and `7.24.2`. CERT Polska reported flaws affecting SSH authentication and RSA signature validation, WebFig file access, the `btest` service, and SSH login privilege handling. The issues can permit unauthenticated remote SSH command execution, disclosure of root-owned files that may contain credentials, kernel restarts, privilege escalation, and TLS server impersonation. Organizations running affected RouterOS branches should upgrade immediately to RouterOS `6.49.21` (Long-term), `7.23.4` (Long-term), or `7.24.2` (Stable). Administrators should review RouterOS flagged status and logs for compromise evidence, and investigate unauthorized accounts, scripts, scheduled tasks, firewall, VPN, DNS, NAT, and other configuration changes, particularly on internet-exposed devices.
Sep 11, 2026
MBSD-SOC reported a renewed rise in attack traffic targeting **MikroTik RouterOS** devices vulnerable to `CVE-2018-14847`, a **WinBox directory traversal flaw** affecting versions `6.42` and earlier. The vulnerability allows unauthenticated attackers to read arbitrary files and authenticated attackers to write arbitrary files, and observed activity in August appeared aimed at retrieving the router user database through path traversal. MBSD-SOC said detections had previously spiked in April and May 2022, later declined, and then increased again from mid-August. The campaign largely originated from **Germany**, which accounted for **99.7%** of observed detections, while **Japan** represented **0.3%**. Public exploit and proof-of-concept details for `CVE-2018-14847` have long been available, increasing the risk to organizations still running unpatched RouterOS systems. Defenders were urged to update affected devices to the latest RouterOS release, while also noting the separate severe RouterOS issue `CVE-2023-30799` disclosed later.
Aug 15, 2026