MikroTrick chains together two of six patched vulnerabilities to obtain root privileges on MikroTik devices with SSH exposed to the internet, of which they are more than 120,000.
Networking gear manufacturer MikroTik has released patches for six vulnerabilities in its RouterOS firmware, two of which can be chained together to take over devices without authentication over SSH. The exploit chain, dubbed MikroTrick, is already being used by attackers in the wild.
The vulnerabilities, found by researchers from the CERT Polska, are located in various firmware components, including the SSH server and client, the bandwidth-test service, the X.509 certificate handling code, and the WebFig interface.
“In recent days we have been observing attacks against RouterOS devices accessible from the internet,” the Polish CERT team said in a report. “We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks.”
MikroTik released patches in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21 and advises against enabling the SSH service on the internet interface. Despite this not being the default configuration, over 122,500 MikroTik devices have SSH reachable from the internet according to scans performed by the Shadowserver Foundation, with the highest numbers in Brazil, the US, and Indonesia.
Based in Latvia, MikroTik makes routers, switches, and other networking devices for a wide range of customers, from small businesses to large enterprises. Its products are used across many sectors, including telecommunications, education, and government.
“If you have manually opened this port [SSH], make sure only trusted IP can access it, or better yet, use a strong VPN like WireGuard to access your router and do not open any management ports at all,” the company says in its advisory. “RouterOS will check if your device has been compromised, and set it to ‘Flagged’ status if it is. This will be written in the ‘Log’ section.”
Failure in SSH key validation
The most severe flaw, tracked as CVE-2026-67276, stems from improper validation of users’ RSA public keys, a key component in SSH authentication. SSH is considered a very strong and well-reviewed protocol that relies on public-key cryptography for server and user identity validation and authentication.
Due to an implementation mistake, RouterOS does not compare the entire public key presented by a user, which makes it possible for an attacker who knows the username and the public modulus of the user’s key to craft a private key that allows them to authenticate as that user.
The privilege obtained is that of the targeted user; however, a second vulnerability (CVE-2026-86060) comes into play, allowing them to escalate the privileges to root. This stems from another SSH implementation mistake in handling usernames with special characters at the start. This allows attackers to craft usernames with full administrative privileges on the underlying OS.
Mitigation
The Flagged state mechanism added by MikroTik is an indicator that the router configuration has signs of unauthorized changes, but not which vulnerabilities was used to make them. Furthermore, the absence of this marker does not necessarily indicate that the device is safe and not vulnerable.
“We cannot rule out the existence of vulnerabilities unknown to us that the vendor did not describe in the changelog,” the CERT Polska Team said. “The ‘Flagged’ marker for compromised devices should therefore be treated as an indication of a possible earlier compromise, not as proof that one of the vulnerabilities reported by CERT Polska was exploited.”
If a device does have the Flagged marker, it should be immediately isolated, it’s configuration and logs should be saved, and then it should be reset to factory defaults and reconfigured from a clean file. All keys and passwords used on the device should be rotated.
If the security updates cannot be applied immediately, users should disable or block access to the SSH, WWW/WWW-SSL, and the bandwidth-test server from untrusted networks.
“Do not initiate TLS connections from an unpatched device or use the built-in SSH clients (/system ssh and /system ssh-exec), especially when communication passes through untrusted networks or is directed at untrusted hosts,” the researchers said.
