Mikrotik news · zeroday.news

mikrotik

2 stories

CVE-2026-67276Sep 6, 2026critical

Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”

MikroTik routers are actively being exploited through a vulnerability chain dubbed "MikroTrick," which combines an SSH authentication bypass (CVE-2026-67276) and a privilege escalation flaw (CVE-2026-86060). This allows attackers to gain full administrator control over internet-exposed devices with SSH enabled. Exploitation began as early as September 2nd, prior to the release of patches. Users are urged to update to the latest stable versions and check logs for indicators of compromise, such as failed SSH logins with the username "-2" or the creation of an "ops" user account.

mikrotikSep 6, 2026high

MikroTik Routers Compromised Via Unauthenticated SSH Access

Attackers are exploiting MikroTik routers by accessing their internet-exposed SSH service without requiring any authentication. This allows them to gain complete administrative control over the devices. The exploitation has been ongoing since at least September 2.

Loading

mikrotik

Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”

MikroTik Routers Compromised Via Unauthenticated SSH Access