When a RouterOS device matched an incoming SSH public key against an authorized one, it compared the key type and the modulus. It did not compare the exponent. Signature verification then used the key the client supplied. So an attacker who knew a username and the public modulus of an authorized key could present a key with exponent 1, forge a signature that validated, and open a session as that user without ever holding the private key.

That is CVE-2026-67276, rated 9.2, and on its own it gets an attacker a shell as an existing account. Chained with CVE-2026-86060, also 9.2, it gets them administrator. CERT Polska named the chain MikroTrick, and published it on September 5, 2026 after confirming it was already being used against devices with SSH reachable from the internet (CERT Polska, Help Net Security).

The second link in the chain

CVE-2026-86060 is an argument-handling flaw in the SSH login path. A username beginning with a character RouterOS is supposed to reject is instead passed along in a way that changes the session's trusted policy mask, which is how a user-level foothold becomes an administrative one (CERT Polska, SecurityWeek). CISA's KEV entry describes it as improper neutralization of argument delimiters in a command, the classic shape: a string that should have been data gets read as structure.

Put the two together and there is no credential step anywhere in the sequence. The attacker needs network reach to the SSH port and a username. The rest is a property of the parser.

The patch was out before anyone knew what it fixed

CERT Polska found evidence of successful exploitation going back to at least September 2, a day before any fix existed. MikroTik shipped patched builds on September 3, in 6.49.21 (long-term), 7.23.4 (long-term), and 7.24.2 (stable), with release notes that referred only to an important security update. CERT Polska's advisory followed on September 5, and declined to publish exploit code while noting that the patched packages were already public and that comparative analysis of them had let others reconstruct some of the fixed bugs (CERT Polska, Cybernews). On September 10, CISA added CVE-2026-86060 and CVE-2026-67277 to the Known Exploited Vulnerabilities catalog, which makes remediation mandatory for US federal civilian agencies and a reasonable forcing function for everyone else (The Hacker News).

A quiet release note buys a few days of head start against attackers who diff binaries. It also means any patch process that waits for a CVE or a severity rating stood still for that whole window.

122,500 devices, and most of them are not in anyone's inventory

The Shadowserver Foundation counted more than 122,500 RouterOS devices with SSH reachable from the public internet in a single scan window on September 5. The largest concentrations were Brazil with roughly 11,300, the United States and Indonesia with about 7,100 each, then the Czech Republic and Ukraine (Cybernews).

MikroTik's default firewall blocks SSH from the internet, and the vendor's advisory says so plainly (MikroTik). Every one of those 122,500 devices is a place where somebody opened the port on purpose, usually so a remote site could be managed without a trip. That is the recurring shape of edge exposure in industry: the gear is cheap, capable, and bought by the people who need the site online, rarely the team that maintains the asset register.

For an operator, the relevant estate is the one that never made it onto the network diagram: pump stations, substations, telemetry huts, solar sites, CCTV backhaul, contractor-installed links at leased facilities. Compromise of the router at one of those sites is not a router problem. Its configuration holds credentials and tunnel material, traffic through it can be redirected or mirrored, and whatever sits behind it is now reachable from a position every firewall rule on the path is designed to trust.

Nor is it the only recent route in. Six weeks earlier, CISA published ICSA-26-211-01 for CVE-2026-14227, where a RouterOS API session keeps the permissions it was created with after the account is downgraded, with the documented impact being extraction of the router's WireGuard private key in plaintext from a low-privilege session.

Four other bugs on the same box

CERT Polska disclosed six vulnerabilities, not two, and the rest say more about the management plane than any single parser.

CVE-2026-67279 lets an unauthenticated client reach the SSH connection protocol after a client-requested rekey, without authentication ever being attempted, and send an exec request the server dispatches, allowing files in the managed namespace to be created and overwritten. CVE-2026-67277 is the btest service accepting a related connection before the primary session authenticates, with an integer underflow that can restart the kernel. CVE-2026-67281, scored 8.7 under CVSS v4.0, is an unauthenticated file read in the WebFig web interface, where a stale principal pointer on the /jsproxy path plus directory traversal exposes root-owned configuration files including stored credentials (CERT Polska, CyCognito).

Those need no credentials either. If your response to MikroTrick is to patch SSH and move on, the WebFig path is still there, handing over the configuration file that holds the credentials you were protecting.

How to tell whether it already happened

CERT Polska published indicators that need no tooling you do not already have. Look for failed logins with the username -2, for system history entries of the form ssh:-2@ followed by user creation or firewall rule changes, and for a highly privileged account named ops, which is what the confirmed takeovers created (CERT Polska, Security Affairs). The advisory also lists attacker source addresses.

MikroTik added a check of its own. On upgraded builds, a startup inspection that finds suspicious configuration sets the device to a flagged state, logs it, and disables the offending entries; the flag appears in /system/device-mode/print. An unflagged device is not a cleared device, though, and the vendor's own advice after upgrading is still to read the configuration for scripts, users, and entries nobody recognizes (MikroTik).

What to do this week

  1. Find the devices before you patch them. Locate RouterOS across every site, including the ones a contractor installed and the ones that arrived with an acquisition. A version check you cannot run is not a control.
  2. Patch to 6.49.21, 7.23.4, or 7.24.2 or later, and treat the upgrade as remediation for six bugs rather than for the one with a name.
  3. Hunt on anything that had SSH or WebFig exposed before September 3. Check for the -2 login artifacts and the ops account, read /system/device-mode/print, and review the configuration export for unfamiliar users, scripts, and schedulers.
  4. Rotate what the device knew. Router credentials, SNMP strings, RADIUS secrets, and VPN keys on a box someone else may have administered are not still secret.
  5. Close the management plane rather than patching it. SSH and WebFig belong on a restricted management network or behind a VPN, not on a public address with an allowlist attached. MikroTik's own advice is to open no management ports at all.
  6. Write down who owns each edge device. Most of the delay in an event like this is not technical. It is the day spent working out which team or integrator is responsible for a site nobody has visited this year.

Where MBCTG fits

The hard part of MikroTrick is not the patch, it is knowing where the boxes are. Passive asset visibility on the plant and site networks, the foundation of our OT security services, answers that without scanning equipment that does not tolerate being scanned: which devices route between a site and the business, what they talk to, and which run firmware nobody has touched since commissioning.

Detection matters here too, because an attacker with administrative rights on a router needs no malware. Our 24/7 SOC is oriented toward what that access looks like in traffic: an administrative session from an address that has never managed anything, configuration changes outside a maintenance window, a site reaching hosts it has no reason to reach. Who owns each site device, and how its firmware gets approved and applied, is what our GRC services turn into a documented control instead of site-by-site improvisation.

If you are not sure what routes traffic at your remote sites, or who opened which management port and when, talk to an MBCTG expert. Building that inventory is a short engagement that pays for itself the next time a vendor patches quietly.