MikroTik RouterOS bugs actively exploited in device takeover attacks

📅 7 September 2026 at 08:13 UTC📰 Cyber InsiderView original source ↗

CERT Polska is warning MikroTik customers to urgently update RouterOS after confirming that attackers are exploiting two critical SSH vulnerabilities to gain full administrative access to internet-exposed devices. The Polish national cybersecurity team disclosed six RouterOS vulnerabilities on September 5, including two flaws it combined into an attack chain named MikroTrick. CERT Polska says it … The post MikroTik RouterOS bugs actively exploited in device takeover attacks appeared first on CyberInsider.

🤖 AI BriefingAuto-generated threat analysis

🔍Threat Overview

MikroTik RouterOS devices are being actively exploited in device takeover attacks via two critical SSH vulnerabilities, CVE-2026-67276 and CVE-2026-86060, which allow attackers to gain full administrative access to internet-exposed devices.

⚙️Technical Details

CVEs

CVE-2026-67276CVE-2026-86060CVE-2026-67277Affected Systems: MikroTik RouterOSAttack Vectors: SSH vulnerabilities, including authentication bypass and privilege escalation

Affected Systems

MikroTik RouterOS

Attack Vectors

SSH vulnerabilities, including authentication bypass and privilege escalation

💥Impact Assessment

Severity: critical

Who Is at Risk

MikroTik customers with internet-exposed devices running RouterOS

🛡️Recommended Actions

1Immediately update to the latest RouterOS version (7.25beta3, 7.24.2, 7.23.4, or 6.49.21)

2Restrict access to SSH, WWW/WWW-SSL, and bandwidth-test services to trusted management networks

3Inspect devices for unknown users, scripts, scheduler tasks, proxies, tunnels, or other configuration changes