MikroTik routers targeted by active SSH zero-day exploitation

As outlined in Security Affairs, MikroTik routers running RouterOS are currently being actively exploited through a chain of vulnerabilities dubbed MikroTrick, allowing attackers to gain full control of devices with SSH exposed to the internet. Cybersecurity expert Costin Raiu and CERT Polska have detailed the ongoing attacks, which began as early as September 2, 2026, before patches were widely available.

The MikroTrick attack chain exploits two critical vulnerabilities: CVE-2026-67276, an SSH authentication bypass, and CVE-2026-86060, an SSH session privilege escalation. By combining these flaws, an unauthenticated attacker can achieve administrator-level access to internet-exposed RouterOS devices with SSH enabled. Exploitation has been observed since at least September 2, with attacks originating from IP addresses 82.192.72.4 and 103.102.31.18. Indicators of compromise include failed login attempts showing username "-2" and system history entries like "ssh:-2@", followed by actions such as user creation or firewall rule modification. The creation of an "ops" account is also a confirmed indicator.

MikroTik has released patched versions, including 7.24.2 and 6.49.21, urging immediate updates and log inspection for signs of compromise. Devices with default firewall configurations and SSH not exposed to the public internet are likely protected, but all others should be patched and audited.

Source: Security Affairs