Hackers are actively exploiting a chain of two critical vulnerabilities in MikroTik RouterOS to take full control of routers with SSH exposed to the internet, according to an urgent warning from Poland's CERT agency, which discovered the flaws with assistance from AI models.
Poland's Computer Emergency Response Team (CERT Polska) has disclosed a pair of critical vulnerabilities in MikroTik RouterOS that are actively being exploited in the wild. The attack chain, dubbed 'MikroTrick,' allows unauthenticated attackers to bypass SSH authentication and escalate privileges to gain full administrative control over affected devices.
The first vulnerability, CVE-2026-67276, is an SSH authentication bypass caused by incomplete validation of RSA public keys. An attacker who knows a username and the public modulus of that user's key can craft a different key to log in without the legitimate private key. The second issue, CVE-2026-86060, is a privilege escalation flaw that allows attackers to obtain full administrative privileges via a specially crafted username.
CERT Polska warned it has observed attacks against RouterOS devices accessible from the internet. "We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks," the agency stated.
The vulnerabilities were discovered by CERT Polska with the help of GPT-5.5-cyber and GPT-5.6-sol and received a critical severity rating. A third flaw, CVE-2026-67277, affecting the bandwidth-test service, could allow unauthenticated attackers to leak kernel memory or crash the router.
MikroTik released fixed versions — RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21 — on September 3. The updates include a compromise-detection mechanism that checks for signs of unauthorized configuration changes at startup, disables malicious entries, and logs critical warnings. However, CERT noted that the absence of such a marker does not guarantee a device has not been compromised.
Organizations unable to patch immediately are advised to restrict or disable external SSH, web services, and the bandwidth-test service, and to avoid using built-in SSH clients or outbound TLS connections over untrusted networks. Suspected compromised devices should be isolated, logs preserved, factory-reset, and rebuilt from a trusted configuration.
Analysis
Why This Matters
- Direct threat to network infrastructure: MikroTik routers are widely used by ISPs, small businesses, and enterprises globally. Successful exploitation hands attackers full administrative control, enabling further network penetration, traffic interception, or use in botnets.
- Active exploitation confirmed: The warning from CERT Polska is not hypothetical — attackers are already scanning for and compromising vulnerable devices. With a pre-patch window of only a few days, many organizations may not have updated.
- AI-assisted vulnerability discovery: The use of GPT-5.5-cyber and GPT-5.6-sol in identifying these flaws highlights the growing role of AI in cybersecurity research, with potential implications for both offense and defense.
Background
MikroTik is a Latvian networking hardware manufacturer whose RouterOS operating system powers millions of routers and switches worldwide. The devices are popular due to their low cost and extensive feature set, but they have historically been a target for cybercriminals and state-sponsored actors. Previous RouterOS vulnerabilities have been exploited to build botnets, including the infamous Meris botnet in 2021-2022. CERT Polska, Poland's national cybersecurity agency, regularly conducts vulnerability research on widely deployed systems and has collaborated with AI tools to accelerate threat discovery.
Key Perspectives
MikroTik (vendor): Released patches within what appears to be a short turnaround after disclosure, and added a built-in compromise-detection mechanism. The company deliberately withheld technical details to give users time to patch, indicating a responsible disclosure process.
CERT Polska (discoverers): Took the lead in identifying, validating, and publicly warning about the vulnerabilities. Their advisory is unusually detailed, providing IoCs and mitigation advice, reflecting a priority on preventing mass exploitation.
Network administrators and users: Face a pressing operational decision: patch immediately, potentially during business hours, or implement workarounds that may break legitimate SSH-based management. The compromise-detection feature is useful but, as CERT notes, not definitive — meaning a clean scan does not prove safety.
What to Watch
- Patch adoption rate: How quickly MikroTik users apply the updates. Large ISP deployments may take weeks to schedule maintenance windows.
- Post-exploitation activity: Whether compromised routers are used for DDoS, data theft, or as entry points to internal networks. Early attacks may indicate preparatory scanning for larger campaigns.
- Further AI-discovered vulnerabilities: CERT Polska's use of AI models for vulnerability research may set a precedent for other national CERTs and security firms, potentially accelerating the disclosure cycle.