MikroTik has released emergency RouterOS security updates after researchers confirmed that attackers are actively exploiting a high-severity SSH authentication bypass against internet-facing routers. Tracked as CVE-2026-67276 and rated 9.2 on the CVSS scale, the flaw allows an attacker to authenticate as an existing RouterOS user without possessing that user’s legitimate RSA private key.
The vulnerability becomes significantly more dangerous when combined with CVE-2026-86060, a separate SSH privilege-escalation weakness. CERT Polska has named the two-stage attack chain MikroTrick and confirmed that attackers are using it to obtain full administrative control of RouterOS devices whose SSH service is reachable from public networks.
Evidence indicates that exploitation began as early as September 2, 2026, one day before MikroTik publicly released patched RouterOS builds on September 3. Successful attacks have created highly privileged accounts, modified device configuration, and established access that may survive until administrators actively investigate and rebuild compromised systems.
The broader group of MikroTrick Flaws disclosed by CERT Polska includes six RouterOS vulnerabilities affecting SSH server and client functionality, the bandwidth-test service, X.509 certificate validation, and the WebFig management interface. However, CVE-2026-67276 and CVE-2026-86060 form the combination currently confirmed in active full-device takeover attacks.
CVE-2026-67276 analysis
The vulnerability originates in the way RouterOS validates RSA public keys during SSH authentication. RouterOS did not compare the complete public key associated with an authorized user. Instead, only part of the RSA key was sufficiently validated, allowing a specially constructed alternative key to be accepted under conditions where it should have been rejected.
The most important details for CVE-2026-67276 are that an attacker needs to know a valid RouterOS username and the public modulus associated with that user’s authorized RSA SSH key. The attacker can then construct another key that passes the vulnerable validation process and authenticate without possessing the corresponding private key.
Successful exploitation of this flaw alone gives the attacker the same RouterOS permissions assigned to the impersonated account. If the targeted user already has administrative rights, that may directly provide significant control over the device. When the user’s permissions are more limited, attackers can combine the flaw with CVE-2026-86060 to escalate further.
CVE-2026-86060 stems from improper handling of specially crafted SSH usernames beginning with a prohibited character. The flaw allows manipulation of the RouterOS policy mask associated with the SSH session, enabling privilege escalation to full administrative rights. CERT Polska confirms that exploiting the two weaknesses together enables unauthenticated takeover of a RouterOS device when SSH is exposed.
This chain is especially important because it removes the usual requirement to steal a valid administrator password or private SSH key. An external actor capable of reaching the SSH service may be able to move from crafted authentication attempts to a privileged RouterOS session and then perform administrative operations.
Attempts to exploit MikroTik RouterOS in observed attacks have focused on devices exposing SSH directly to the internet. MikroTik notes that default home configurations are generally not immediately exposed, but administrators who have enabled public SSH or changed firewall rules may face substantially greater risk.
CVE-2026-67276 affects the following RouterOS release ranges:
- RouterOS 7.24 through versions before 7.24.2
- RouterOS 7.0.0 through versions before 7.23.4
- RouterOS 6.0.0 through versions before 6.49.21
CERT Polska categorized the vulnerability as CWE-347: Improper Verification of Cryptographic Signature. All six RouterOS security issues disclosed in the same research share the same broad affected release ranges.
The vulnerability was discovered by CERT Polska as part of security research performed in coordination with MikroTik. Researchers used an agent-based laboratory environment supported by AI models to analyze RouterOS components, compare software versions, model protocol states, and validate hypotheses against real test systems. Each finding was subsequently confirmed manually and through repeat testing before disclosure.
The precise private discovery date has not been published. MikroTik released the security fixes on September 3, 2026, while CERT Polska published technical information and the assigned CVEs on September 5. Real-world evidence indicates that attackers were already exploiting the chain by September 2, giving the campaign zero-day characteristics.
Researchers have confirmed successful attacks originating from 82.192.72[.]4, with exploitation attempts also associated with 103.102.31[.]18. Observed compromises created a highly privileged RouterOS user named ops.
Security Affairs also reported infrastructure at 82.192.72[.]4 hosting a MIPS BusyBox binary and files named ftpsrv.py, launch.sh, and serve.py. The available evidence has not yet tied the activity to a named threat group or established whether the compromised routers are being assembled into a botnet, proxy network, espionage infrastructure, or another operation.
The observed attack chain leaves particularly useful artifacts in RouterOS logs and configuration history. Failed exploitation attempts can generate entries resembling:
login failure for user -2 from via ssh
Successful activity may subsequently appear as:
user added by ssh:-2@
The string -2 is especially suspicious because it is not a normal RouterOS username and has been associated with exploitation of the privilege-manipulation stage.
A public CVE-2026-67276 PoC has now appeared for controlled laboratory testing of the SSH authentication weakness. Its availability further lowers the barrier for independent reproduction of the flaw, reinforcing the need to patch before scanning and exploitation become more widespread.
Useful CVE-2026-67276 IOCs currently include the two observed source IP addresses, the abnormal -2 SSH username, the ops account, and configuration changes attributed to ssh:-2@. Security Affairs additionally published hashes for several files recovered from associated attacker infrastructure.
CVE-2026-67276 Mitigation
MikroTik and CERT Polska recommend upgrading RouterOS immediately. Fixes are available in:
- RouterOS 7.25 beta 3 or later
- RouterOS 7.24.2 or later
- RouterOS 7.23.4 or later
- RouterOS 6.49.21 or later
MikroTik subsequently released RouterOS 7.23.5 after an IPv6 DHCP regression was discovered in 7.23.4. Organizations using the long-term 7.23 branch should therefore use the latest available maintenance build rather than intentionally stopping at 7.23.4.
After updating, RouterOS performs a startup check for selected known indicators of unauthorized configuration changes. If suspicious modifications are identified, the device is assigned a Flagged status, the relevant configuration entries can be disabled, and a critical warning is written to the system log.
Administrators can inspect this state with:
/system/device-mode/print
A Flagged result should be treated as evidence that the device may have been compromised. However, both MikroTik and CERT Polska emphasize that the absence of the Flagged marker does not prove that a router is clean, because the mechanism only detects selected known artifacts.
CVE-2026-67276 detection should therefore combine patch verification with log review, configuration inspection, and analysis of recently created accounts and administrative changes.
To Detect CVE-2026-67276 exploitation or related MikroTrick activity, defenders should look for:
- login failure for user -2 … via ssh
- Administrative actions attributed to ssh:-2@
- An unexpected privileged account named ops
- Connections involving 82.192.72[.]4
- Connections involving 103.102.31[.]18
- Newly added or modified SSH public keys
- Unknown users or changed user permissions
- Unexpected RouterOS scripts
- Suspicious scheduler tasks
- Newly enabled proxies or tunnels
- Unexplained firewall or NAT modifications
- Packet-sniffing or traffic-forwarding configuration that administrators did not create
- Other unexpected configuration changes following SSH activity
If administrators cannot patch immediately, CERT Polska recommends disabling externally exposed services or restricting them exclusively to trusted management networks. This applies particularly to SSH, WWW/WWW-SSL, and the bandwidth-test server.
Unpatched devices should also avoid initiating SSH or TLS connections toward untrusted systems. CERT Polska specifically recommends avoiding RouterOS’s built-in /system ssh and /system ssh-exec clients until updates are installed because other vulnerabilities disclosed in the same research affect RouterOS client-side trust and protocol handling.
These measures reduce exposure but do not replace the vendor update.
If logs, the Flagged status, an unknown ops account, or other configuration evidence suggests compromise, administrators should treat the router as fully controlled by an attacker. The affected device should be isolated, and relevant logs and configuration evidence should be preserved before remediation.
CERT Polska then recommends restoring the device to factory settings and rebuilding the configuration from a trusted and verified source. Administrators should not simply restore a complete backup created from a potentially compromised router because malicious users, scripts, SSH keys, scheduler entries, proxies, or tunnels could be reintroduced.
All passwords, SSH keys, API credentials, VPN secrets, and other authentication material exposed to or stored on a compromised device should also be rotated.
The CVE-2026-67276 mitigation priority is particularly high for routers that exposed SSH to the public internet before September 3. Because active attacks began before the security update became publicly available, patching those systems should be accompanied by retrospective investigation rather than treated solely as preventive maintenance.
FAQ
What is CVE-2026-67276 and how does it work?
CVE-2026-67276 is a high-severity SSH public-key authentication bypass in MikroTik RouterOS. RouterOS failed to fully compare an authorized RSA public key during authentication. An attacker who knows a valid username and the public modulus of its authorized key can craft another key that RouterOS incorrectly accepts, allowing SSH login without possession of the legitimate private key. The resulting permissions match those of the targeted user.
When was CVE-2026-67276 first discovered?
The exact private discovery date has not been disclosed. CERT Polska discovered the issue during its RouterOS security research and coordinated remediation with MikroTik. MikroTik published patched versions on September 3, 2026, while CERT Polska publicly disclosed the vulnerability on September 5. Evidence shows exploitation was already occurring from at least September 2.
What is the impact of CVE-2026-67276 on systems?
Successful exploitation allows an attacker to impersonate an authorized SSH user without knowing the user’s private RSA key. The attacker inherits that account’s privileges. When chained with CVE-2026-86060, the attack can provide full RouterOS administrative access without prior authentication, enabling modification of users, SSH keys, firewall rules, scripts, proxies, tunnels, and other device configuration.
Can CVE-2026-67276 still affect me in 2026?
Yes. RouterOS installations remain vulnerable if they run affected releases and have not received the September security updates. Devices with SSH accessible from the public internet face the greatest immediate risk because CERT Polska has confirmed active exploitation of the MikroTrick chain against exactly this type of exposure.
How can I protect myself from CVE-2026-67276?
Upgrade immediately to RouterOS 7.24.2, the latest 7.23 long-term release, 6.49.21, 7.25 beta 3, or a newer fixed version appropriate for your deployment. Restrict SSH and other administrative services to trusted networks, inspect the Flagged status and logs, search for unknown users and configuration changes, and factory-reset and rebuild any device showing evidence of compromise.