MikroTik patches flaws being exploited in router takeover attacks

Key Points

• According to NetworkWorld, MikroTik patched six RouterOS vulnerabilities, two of which can be chained to hijack devices via SSH without authentication.
• The exploit chain combines CVE-2026-67276 (SSH key validation) and CVE-2026-86060 (username handling) to gain root access.
• Fixed versions are RouterOS 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21; over 122,500 devices still expose SSH to the internet.

What is changing

MikroTik released patches that close six RouterOS flaws, with the most serious being CVE-2026-67276, which lets attackers forge SSH keys if they know the target username and public modulus. The flaw was discovered by CERT Polska and is being actively exploited in the wild to take over routers without authentication. When combined with a second vulnerability, it grants full administrative control.

The updates also fix RouterOS 7.24.2 and related builds, correcting CVE-2026-86060 that mishandles usernames with special characters; MikroTik advises disabling SSH on public interfaces or restricting it to trusted IPs. According to Shadowserver scans, over 122,500 devices still have SSH reachable from the internet, with the highest concentrations in Brazil, the US and Indonesia. MikroTik’s advisory notes that a Flagged status in the log indicates possible compromise.

Why it matters

This issue mainly affects network admins who manage MikroTik routers in branch offices, data centers or remote sites where SSH is left open for management. Enterprises that use MikroTik gear for telecommunications, education or government networks may see unauthorized configuration changes or data theft if the devices are compromised. The risk is highest where SSH is exposed to the internet without additional protection.

The practical takeaway is to apply the latest RouterOS version or block SSH from untrusted networks; risk is limited to devices with SSH exposure from the internet, which is not the default but still affects over 100k units. Administrators should also rotate SSH keys and passwords, review logs for the Flagged marker, and consider using a VPN like WireGuard for remote access. Prompt patching reduces the chance of persistent attacker footholds.

Share your patching experience or thoughts on securing MikroTik gear in the comments below.

Read the original source.