MikroTik has issued an urgent advisory for its RouterOS, confirming active exploitation of a critical vulnerability chain, dubbed "MikroTrick," that allows unauthenticated attackers to gain full control of devices with SSH exposed to the internet. The company released patches on September 3, 2026, but evidence suggests exploitation began as early as September 2, making it a zero-day event.
The MikroTrick attack chain leverages two of six vulnerabilities identified by CERT Polska: CVE-2026-67276 (CVSS 9.2), an SSH authentication bypass, and CVE-2026-86060, an SSH session privilege escalation. The authentication bypass flaw allows an attacker who knows a valid username and the public part of an RSA key to forge a key and log in without the corresponding private key. When combined with the privilege escalation, this grants full administrative access to the device.
MikroTik has released fixes in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, 7.23.5, and 6.49.21. Users are strongly advised to update their devices immediately. CERT Polska and cybersecurity researchers have stressed that any MikroTik router with SSH accessible from the internet should be considered compromised until proven otherwise.
Observed attacks have originated primarily from the IP address 82.192.72[.]4, hosted by Leaseweb, which has been seen serving a MIPS build of BusyBox 1.16.1 along with Python scripts named `ftpsrv.py`, `launch.sh`, and `serve.py`. Another IP, 103.102.31[.]18, has also been linked to the campaign.
Defenders can identify potential compromises by examining router logs for specific indicators. A key sign of attempted exploitation is the appearance of the username "-2" in failed SSH login attempts. This is not a valid account and should not appear in normal logs. Successful attacks will show entries in `/system history` such as `ssh:-2@IP` followed by actions like creating new users, adding SSH keys, modifying firewall rules, or enabling proxy or tunnel services. The creation of an account named "ops" is another confirmed indicator of compromise.
It is important to note that the absence of "-2" login failures in current logs does not definitively mean a device is safe, as logs may have been rotated or cleared. Any configuration change associated with the "-2" user, particularly those related to user management, SSH keys, scripts, schedulers, services, firewall rules, proxies, tunnels, or packet sniffing, should be treated as a confirmed compromise unless it was part of an authorized security test.
MikroTik took the unusual step of sending push notifications through its official mobile app to alert users about these critical vulnerabilities, highlighting the severity of the situation. While devices with MikroTik's default firewall configuration that do not expose SSH to the public internet are likely protected, any device with SSH reachable from untrusted networks requires immediate patching and inspection.
