Attackers began compromising internet-exposed MikroTik routers on Sept. 2, a day before the Latvian vendor released fixes and three days before national authorities published the technical detail defenders needed to detect the intrusions.
What is the MikroTrick vulnerability chain?
CERT Polska disclosed six RouterOS vulnerabilities Sept. 5 and gave the two-flaw chain seen in the wild a common name, “MikroTrick.” CVE-2026-67276, rated 9.2, is an SSH authentication bypass. RouterOS verified the type and modulus of a public key during authentication but omitted the exponent, letting an attacker who knows a username and the RSA modulus forge a matching key and authenticate without ever holding the private one.
CVE-2026-86060, also rated 9.2, is an argument injection flaw in which an SSH username beginning with a disallowed character escalates the session to full administrative rights. Chained, the two give an unauthenticated attacker complete control of any device with SSH reachable from the internet.
A third flaw, CVE-2026-67277 at 8.8, permits unauthenticated access to privileged state through the bandwidth-test service. CERT Polska credited the discoveries to its own team, which said it used OpenAI’s GPT-5.5-cyber and GPT-5.6-sol models under the vendor’s Government and Trust Agency Collaboration program to automate version comparison, RFC analysis and binary review, with researchers independently verifying every finding.
The exposed population is large. Shadowserver counts more than 122,500 MikroTik devices with SSH reachable on the open internet, concentrated in Brazil with 11,300, the United States and Indonesia with 7,100 each, the Czech Republic with 6,300 and Ukraine with 5,100. CERT.LV said it has confirmed 12 compromised devices in Latvia out of several thousand exposed, notified critical infrastructure operators Sept. 3, and recorded intensifying attacks in an update published Sept. 6.
How to check whether your MikroTik router is compromised
Both agencies published the same indicators. Failed logins for a user named -2, system history entries reading ssh:-2@, creation of a privileged account named ops, and a “Flagged” marker RouterOS sets at startup. Attack traffic traced to 82.192.72.4 for successful compromises and 103.102.31.18 for attempts.
MikroTik shipped 6.49.21, 7.23.4, 7.24.2 and 7.25beta3 on Sept. 3 and pushed alerts through its mobile app, but declined to publish specifics, saying it was withholding detail to give users time to update. The embargo held about a day.
Network engineer Nick Pratley published a binary diff of RouterOS 7.23.3 against 7.24.2 on Sept. 4, reconstructing three of the fixes and releasing working proof-of-concept code. Shipping patched binaries worldwide, he argued, makes the diff itself the disclosure. A separate lab proof-of-concept for CVE-2026-67276 has since been posted to GitHub.
Why MikroTik’s silent patch drew criticism
The sequencing is what draws criticism. Because exploitation preceded the patch, the withheld detail was not being kept from an attacker who lacked it. It was being kept from administrators who had no way to know they were already being targeted.
There is a regulatory dimension approaching. MikroTik is headquartered in Riga, and from Sept. 11 the EU Cyber Resilience Act requires manufacturers to file an early warning within 24 hours of learning a product is under active exploitation, routed through a platform operated by ENISA. A repeat of this week’s sequence after that date would start a regulatory clock rather than leaving disclosure timing to vendor discretion.
