Poland's national computer emergency response team, CERT Polska, has confirmed that two critical vulnerabilities in MikroTik's RouterOS operating system are being actively exploited in the wild, with documented compromises dating back to at least 2 September 2026. The flaws, tracked as CVE-2026-67276 and CVE-2026-86060, form an attack chain the researchers have named MikroTrick, which allows unauthenticated adversaries to seize full administrative control of any router whose SSH management interface is reachable from the public internet.

How the MikroTrick chain works

The first vulnerability, CVE-2026-67276, resides in the RouterOS SSH server's key verification logic. Because the server fails to properly validate presented keys, an attacker can generate a key pair that the device accepts as legitimate, granting initial access without any password or credential. The second flaw, CVE-2026-86060, is triggered by specially crafted usernames that escalate that initial foothold directly to administrative privileges. Both vulnerabilities carry the maximum CVSS base score of 9.2, reflecting their ease of exploitation and the complete compromise they enable.

CERT Polska's advisory notes that the six vulnerabilities disclosed through the coordinated process were discovered only because the team observed active attack traffic against RouterOS devices. In other words, the exploitation preceded the discovery, a reminder that threat actors are often ahead of coordinated disclosure timelines, particularly when management interfaces are left exposed.

Attack timeline and infrastructure

Forensic analysis by CERT Polska links the earliest confirmed successful intrusions to the IP address 82.192.72.4, with activity observed from 2 September onwards. A second address, 103.102.31.18, appears in subsequent exploitation attempts. The Polish CERT has not attributed the activity to a specific threat actor or campaign, and the geographic origin of the infrastructure remains unclear; both addresses could be compromised hosts, proxy layers, or dedicated attack servers.

The targeting is opportunistic rather than selective: any RouterOS device with SSH open to the internet is at risk. MikroTik hardware is widely deployed across Europe in small-office, home-office, and ISP-managed customer-premises equipment, meaning the potential attack surface spans thousands of networks in Germany, Poland, the Baltic states, and beyond.

Implications for European network operators

The incident underscores a persistent operational weakness: management protocols such as SSH, Telnet, HTTP, and Winbox are routinely left exposed on perimeter devices despite years of guidance to restrict them to dedicated management VLANs or VPN-only access. Under the EU's NIS2 Directive, which entered into force in 2024 and applies to a broad range of essential and important entities including digital infrastructure providers, operators of such equipment have a legal obligation to manage vulnerabilities promptly and report significant incidents. Failure to patch known, actively exploited flaws on internet-facing assets could constitute non-compliance.

German operators, in particular, should take note. The Bundesamt für Sicherheit in der Informationstechnik (BSI) has long advised against exposing router management interfaces, and the agency's baseline protection compendium explicitly recommends disabling SSH on WAN interfaces or restricting it to known administrative IP ranges. The MikroTrick campaign provides a concrete, real-time illustration of why that guidance exists.

Mitigation steps and remaining questions

MikroTik has released RouterOS updates addressing all six vulnerabilities disclosed by CERT Polska. Administrators should apply the patches immediately, but patching alone is insufficient for devices that may already have been compromised. Because the attack chain grants full administrative control, an adversary could have installed persistent backdoors, modified firmware, or harvested credentials for lateral movement. CERT Polska advises that any device with SSH exposed to the internet during the exposure window be treated as potentially compromised: isolate, reimage from a known-good backup, rotate all credentials, and inspect logs for anomalous administrative sessions.

Several questions remain unanswered. The full scope of successful compromises is unknown; CERT Polska has only confirmed the two source IPs observed in its telemetry. It is unclear whether the vulnerabilities were exploited as zero-days before 2 September, or whether the attackers reverse-engineered patches or disclosure drafts. The identity and motivation of the threat actor, whether criminal, state-aligned, or opportunistic, have not been established. Finally, the six vulnerabilities disclosed suggest a broader attack surface in RouterOS SSH handling that may yield further flaws.

A recurring pattern in network device security

This is not the first time MikroTik devices have featured in large-scale compromise campaigns. In 2018, the VPNFilter malware infected hundreds of thousands of routers and NAS devices, many of them MikroTik units, using known vulnerabilities and default credentials. In 2023, the Meris botnet leveraged a RouterOS vulnerability (CVE-2018-14847) to build a massive DDoS infrastructure. Each wave reinforces the same lesson: network infrastructure devices are high-value targets, often managed with less rigour than servers or endpoints, and their compromise provides a persistent, hard-to-detect foothold in victim networks.

Organisations

CERT Polska · MikroTik