Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet. One of the security issues, tracked as CVE-2026-67276, is an SSH authentication bypass flaw in MikroTik RouterOS caused by incomplete validation of RSA public keys. An attacker who knows a username and the public modulus of that user’s key can exploit it by crafting a different key and logging in without the legitimate private key. The second security issue is identified as CVE-2026-86060. It is an SSH privilege escalation flaw in MikroTik RouterOS due to improper handling of specially crafted usernames. Hackers can leverage it using a specially crafted username to manipulate the SSH session so that the attacker obtains full administrative privileges. Both vulnerabilities were discovered by Poland's CERT agency with the help of GPT-5.5-cyber and GPT-5.6-sol and received a critical severity rating. The Polish agency dubbed the exploit chain “MikroTrick,” and warned that it is now actively exploited in the wild. “In recent days we have been observing attacks against RouterOS devices accessible from the internet,” Poland's CERT warns. “We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks.” The Polish CERT also highlighted a third flaw, CVE-2026-67277, which affects the RouterOS bandwidth-...
Hackers exploit new MikroTik RouterOS flaws to hijack routers
Affected Software
Frequently Asked Questions
Which MikroTik RouterOS devices are at risk from the MikroTrick exploit chain?
The attacks target RouterOS devices with SSH services exposed to the internet. Poland's CERT said it has observed attacks against internet-accessible RouterOS devices in recent days.
How does CVE-2026-67276 allow an attacker to bypass SSH authentication?
The flaw results from incomplete validation of RSA public keys. An attacker who knows a username and that user's public-key modulus can craft a different key and log in without the legitimate private key.
What does CVE-2026-86060 add to the attack chain?
CVE-2026-86060 is an SSH privilege-escalation flaw involving specially crafted usernames. It can be used to manipulate an SSH session and obtain full administrative privileges.
Is exploitation of these flaws confirmed?
Yes. Poland's CERT warned that the exploit chain, which it named MikroTrick, is being actively exploited in the wild. The vulnerabilities received critical severity ratings and were added to KEV on 2026-09-08.