← All news
ARTICLE
21 October 2026 Updated on 23 October 2026 2 min read
Produced by Neska

MikroTik's 'MikroTrick' router bugs: two are KEV-listed, one isn't

CISA's KEV catalog lists two of the three MikroTik RouterOS flaws behind the MikroTrick chain. The SSH bypass that starts the chain isn't on the list yet, but is still exploited.

In this article
  1. How the MikroTrick chain works
  2. Scale
  3. What to do

MikroTik shipped patches for three RouterOS vulnerabilities on September 3, 2026, after evidence that attackers had already begun exploiting them a day earlier. Two of the three — CVE-2026-86060 and CVE-2026-67277 — are in CISA's Known Exploited Vulnerabilities catalog, added September 10 with a remediation deadline of September 13 that has passed. The third, CVE-2026-67276, is the entry point for the attack chain researchers call MikroTrick, but as of this writing it has not itself been added to the KEV catalog, even though the Canadian Centre for Cyber Security and CERT Polska both flag it as actively exploited.

A small black router with five Ethernet ports on a glass surface, in front of a MikroTik RouterBOARD cardboard box
Photo: Uhernandez (CC BY 3.0), Wikimedia Commons.

How the MikroTrick chain works

CVE-2026-67276 (CVSS 9.2) is an SSH authentication-bypass flaw: incomplete validation of RSA public keys lets an attacker who knows a username and the public modulus of that user's key forge a different key and log in without the real private key. CERT Polska named the two-stage chain "MikroTrick" because that bypass combines with CVE-2026-86060 (CVSS 9.2), a privilege-escalation bug triggered by a specially crafted SSH username, to hand the attacker full administrative control. The third bug, CVE-2026-67277 (CVSS 8.8), is a separate, unauthenticated flaw in the RouterOS bandwidth-test service that can leak kernel memory or crash the device — a denial-of-service risk rather than a path to admin access, but reachable without credentials.

Scale

The Shadowserver Foundation counted more than 122,500 internet-facing RouterOS SSH instances in a single scan in early September — a large population of devices that are reachable by design, since RouterOS is common edge and gateway equipment for ISPs and small businesses.

What to do

  • Patch to RouterOS 7.25beta3, 7.24.2 (Stable), 7.23.4 or later on the Long-Term branch, or 6.49.21 on Legacy Long-Term — MikroTik later shipped 7.23.5 after an IPv6 DHCP regression turned up in 7.23.4, so use the latest maintenance build on that branch rather than stopping at 7.23.4.
  • Keep SSH off untrusted networks regardless of patch status.
  • After upgrading, check RouterOS's "Flagged" status indicator, plus logs for unknown users, scripts or configuration changes.
  • Treat any device that was internet-reachable before patching as a candidate for evidence preservation before isolation or a factory reset.

Sources: MikroTik September 2026 security bulletin, Canadian Centre for Cyber Security AL26-020.

← ← All news