RouterOS devices are being actively taken over through a chain of vulnerabilities that grants attackers full administrative control without requiring any credentials. The CERT Polska team, which discovered and coordinated disclosure of the flaws, is urging administrators to update immediately.
The MikroTrick Attack Chain
The attack chain combines two vulnerabilities in RouterOS and has been named MikroTrick. One flaw allows SSH authentication bypass (CVE-2026-67276, CVSS 9.2); the other permits privilege escalation through a crafted username during the SSH login process (CVE-2026-86060, CVSS 9.2). Devices with SSH accessible from public networks are vulnerable.
Observed Exploitation
CERT Polska has confirmed that attacks are underway. The observed exploitation creates a highly privileged user account named ops and leaves specific markers in RouterOS logs. Two IP addresses have been linked to the campaign: 82.192.72.4 and 103.102.31.18.
Affected Components
The vulnerabilities affect RouterOS components including the SSH server and client, the bandwidth-test service, X.509 certificate handling, and the WebFig web interface. A third flaw (CVE-2026-67277, CVSS 8.8) in the bandwidth-test service allows an unauthenticated attacker to leak kernel memory or crash the device remotely.
Patches and Mitigation
MikroTik released fixes in versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. The company took the unusual step of sending push notifications through the MikroTik app to alert users directly.
The patched releases include a new mechanism called Flagged, which scans the configuration at startup for signs of unauthorized changes. Suspicious entries are disabled and a critical log message is written. However, CERT Polska notes that the absence of the Flagged marker does not guarantee a device is clean.
Detection and Investigation
Administrators should update immediately, then check logs for compromise messages and inspect the device configuration for unknown users, scripts, scheduler tasks, proxy servers, and tunnels. Suspicious entries to look for in the logs include: login failure for user -2 from ip via ssh and user name added by ssh:-2@ip.
Temporary Workarounds
If immediate patching is not possible, disable SSH, WWW/WWW-SSL, and the bandwidth-test server from untrusted networks. Refrain from using the built-in SSH clients on unpatched devices, especially when communicating through untrusted networks.
Incident Response
If compromise is suspected, isolate the device, secure logs and configuration before resetting, then restore to factory settings and reconfigure from a trusted backup. Change all passwords, keys, and secrets. Do not restore a full configuration from a potentially compromised device.
AI-Assisted Discovery
The vulnerabilities were discovered using GPT-5.5-cyber and GPT-5.6-sol models as part of an OpenAI Government and Trust Agency Collaboration program. CERT Polska deployed an agent-based research environment with isolated RouterOS test machines. The models accelerated analysis and hypothesis exploration, the team said, but every finding required confirmation on real hardware, negative control testing, and impact assessment by researchers.
MikroTik published the patches before public disclosure, allowing the security community to begin analyzing the fixes. CERT Polska declined to release technical details that would simplify automated exploitation.