Active Exploitation of Critical MikroTik RouterOS Vulnerabilities ("MicroTrick")

Advisory ID: CERT-PL-2026-09
Threat Level: Critical
Targeted Systems: MikroTik RouterOS (v6.x and v7.x) exposed to public networks
Source: CERT Polska Warning

Overview

CERT Polska has identified six critical vulnerabilities in MikroTik RouterOS. Attackers are actively exploiting a chain of two SSH vulnerabilities—dubbed "MicroTrick"—to gain full administrative control of internet-facing MikroTik devices without prior authentication.

Key Vulnerabilities Detailed

• CVE-2026-67276 (CVSS 9.2) – SSH Authentication Bypass:
  Improper verification of RSA public keys during SSH login. An attacker who knows a username and the corresponding public key module can generate a forged key and authenticate via SSH without holding the private key.
• CVE-2026-86060 (CVSS 9.2) – SSH Session Permission Escalation:
  Malformed usernames starting with illegal characters manipulate session permission mechanisms, granting the established connection full administrative privileges on the RouterOS system.
• CVE-2026-67277 (CVSS 8.8) – Bandwidth-Test Memory Leak & DoS:
  Unauthenticated connections can enter a restricted state that should require login. Combined with integer underflow and size-validation flaws, this permits kernel memory disclosure or remote Denial of Service (system reboot).

Indicators of Compromise (IoCs)

• Unauthorized User Account: Presence of an unknown, highly privileged user account named ops.
• Known Attacker IP Addresses: Exploitation attempts and payload delivery originating from:
  • 82.192.72.4 (active since at least Sept 2, 2026)
  • 103.102.31.18
• RouterOS Log Entries:

  login failure for user - 2 from <ip> via ssh
  user <name> added by ssh : - 2 @<ip>
  

Mitigation & Remediation Guidelines

1. Patching

Update RouterOS immediately to a patched release: 7.25beta3, 7.24.2, 7.23.4, or 6.49.21. Refer to the official MikroTik Security Bulletin for release details.

2. Immediate Workarounds (If Patching is Delayed)

• Access Control: Restrict or disable public access to SSH, WebFig (WWW/WWW-SSL), and the bandwidth-test server. Limit access strictly to trusted management IP ranges.
• Outbound Connections: Avoid initializing outbound SSH (/system ssh) or TLS connections from unpatched devices across untrusted networks.

3. Incident Response for Compromised Hosts

• Isolation & Forensics: If a device shows IoCs or displays the "Flagged" status, isolate it immediately. Secure forensic backups of configuration files and system logs following the CERT Polska Guidance on Securing Logs.
• Sanitization: Perform a full factory reset. Manually reconfigure the router from a clean baseline (avoid restoring full, unverified backup files directly).
• Credential Rotation: Rotate all API keys, local administration passwords, and SSH keys associated with the infrastructure.