Small Town Sysadmin
Free CJIS checklist

Networks

Security alert

Patch MikroTik RouterOS now: attackers are taking over routers through SSH

CISA lists three exploited RouterOS flaws from September, and CERT Polska says attacks began by September 2. Here are the fixed versions and how to check for compromise.

If you run MikroTik routers, common as small-office gateways, branch routers, and ISP equipment, update RouterOS now. A set of flaws nicknamed “MikroTrick” can let an attacker take full administrative control of a router whose SSH service is reachable from the internet, without a password. CERT Polska, the Polish national security team that discovered the issues, says active exploitation began by at least September 2, 2026.

What CISA lists as exploited

Added to CISA’s list CVE What it does
September 10 CVE-2026-86060 Lets an attacker escalate privileges through the SSH login process and gain full admin rights
September 10 CVE-2026-67277 Abuses the bandwidth test (btest) service for memory disclosure or denial of service
September 25 CVE-2026-67279 Lets an unauthenticated SSH client reach a session channel; can be chained with CVE-2026-86060 for a full takeover without a password

CISA set remediation deadlines of September 13 and September 28 for federal agencies. If you haven’t updated yet, you’re past both.

Fixed versions

MikroTik released fixes in all channels on September 3. Update to one of these, or later:

  • 7.24.2 (stable)
  • 7.23.4 (long-term)
  • 6.49.21 (long-term, for older v6 devices)
  • 7.25beta3 (testing)

Most routers offer the update under System > Packages > Check for updates.

Lock down management access

MikroTik’s own advice, which is worth following regardless of this alert:

  • Don’t expose SSH to the internet. MikroTik’s default configuration blocks it, but it’s often opened by hand for remote management. If it must be reachable, allow only trusted IP addresses.
  • Better yet, manage routers over a VPN such as WireGuard, and don’t open any management ports to the internet at all.

Check whether a router was already compromised

After upgrading, RouterOS checks itself for signs of compromise:

  1. Look in the Log for a critical entry saying the device has been “Flagged.” If you see one, follow MikroTik’s Flagged status documentation.
  2. Even if it’s not flagged, review the configuration for anything you don’t recognize: unknown users, scripts, scheduled tasks, or firewall and NAT changes.
  3. If you find anything suspicious, treat the router as compromised: rebuild it from a clean install and a known-good configuration, and change every password it held.

For office managers

If your office’s internet router is a MikroTik (the brand name is usually printed on the box), ask whoever manages your network today to confirm it’s been updated.

Sources

All articles