MikroTik patches critical router flaws after active exploitation
MikroTik has released emergency patches for its RouterOS software after researchers discovered a chain of flaws that lets attackers hijack routers without a password or SSH key, according to The Hacker News. CERT Polska calls the chain MikroTrick and says they saw evidence of it being used in the wild as early as September 2.
MikroTik has released emergency patches for its RouterOS software after researchers discovered a chain of flaws that lets attackers hijack routers without a password or SSH key, according to The Hacker News. CERT Polska calls the chain MikroTrick and says they saw evidence of it being used in the wild as early as September 2.
The attack works by chaining two bugs. One flaw (CVE-2026-67279) lets a client skip past the login confirmation step. The second bug (CVE-2026-86060) then tricks the router into granting full administrative access. CISA added the second flaw to its Known Exploited Vulnerabilities catalog on September 10, confirming it’s actively being abused.
If you run a business that relies on MikroTik routers to manage your internet connection or office network, your devices may have been taken over. MikroTik says its default home setup doesn’t expose SSH to the internet, but if your office manager or IT person changed firewall rules to let you manage the device remotely, you’re at risk.
What to check this week
Patching stops the attack, but it doesn’t erase what an attacker did before you updated. You need to look for signs that someone already got in.
- Update your MikroTik RouterOS to version 6.49.21, 7.23.4, or 7.24.2 immediately.
- Check your SSH login logs for the username ‘-2’. This indicates a failed attempt by the attacker. (CERT Polska)
- Look for a new user account named ‘ops’ in the full privilege group. Attackers create this to maintain access. (CERT Polska)
If you find these indicators, isolate the device, preserve its logs, factory reset it, and rebuild it from a trusted configuration. Change all passwords and keys, and don’t restore backups from a potentially compromised device. (CERT Polska)
Look, if you don’t know how to check SSH logs or update RouterOS, don’t guess. Call whoever handles your office network and tell them to patch this today.
Sources: The Hacker News.
