Executive Summary
MikroTik RouterOS is under confirmed active exploitation for a September 2026 vulnerability set that CERT Polska codenamed MikroTrick. CISA added CVE-2026-67277 and CVE-2026-86060 to the Known Exploited Vulnerabilities catalog on September 10, 2026 (due date September 13, 2026; known ransomware campaign use = Unknown). CERT.pl reports earliest public attack logs from September 2, 2026—before vendor patches published September 3, 2026—and confirms exploitation against internet-reachable SSH yielding full administrative console access without password, SSH key, or completed authentication when the MikroTrick chain succeeds.
Naming note (do not conflate): CERT.pl defines the MikroTrick unauthenticated full-admin chain as CVE-2026-67279 (SSH protocol/state flaw enabling unauthenticated session/channel reach) combined with CVE-2026-86060 (SSH login-path argument/policy-mask privilege escalation). CISA KEV lists CVE-2026-67277 and CVE-2026-86060, not CVE-2026-67279. Both framings are sourced; this advisory covers the two KEV CVEs as primary and documents the CERT.pl chain and adjacent CVEs without inventing a reconciliation.
CVE-2026-67277 is Missing Authentication for Critical Function (CWE-306) in bandwidth-test (btest)—unauthenticated related-session path leading to kernel memory disclosure / DoS (kernel restart). CVSS 4.0 8.8 High (CERT.pl); NVD CVSS 3.1 8.2 High.
CVE-2026-86060 is Improper Neutralization of Argument Delimiters (CWE-88) in the SSH login path—can change trusted RouterOS policy mask → privilege escalation; exploitation requires an unauthenticated SSH session that reaches the login helper. CVSS 4.0 9.2 Critical (CERT.pl); NVD CVSS 3.1 9.8 Critical.
Adjacent (not KEV as of pack date): CVE-2026-67279 is the CERT.pl chain prerequisite (CVSS 4.0 6.9 Medium). CVE-2026-67276 is a vendor-adjacent SSH RSA key verification flaw (CVSS 4.0 9.2 Critical; 7.x only)—CERT.pl states it is not the MikroTrick chain and some publications incorrectly associate it with the chain.
Fixed builds (MikroTik / CCCS / CERT): 6.49.21; 7.23.4; 7.24.2; 7.25 beta 3.
Technical Information
CVE-2026-67277 — bandwidth-test (btest) missing authentication
Missing Authentication for Critical Function in btest enables an unauthenticated related-session path that can disclose kernel memory and cause remote DoS via kernel restart (NVD / CERT.pl). Interim guidance until patched: disable or block bandwidth-test server from untrusted addresses (CERT.pl).
CVE-2026-86060 — SSH login path argument / policy-mask privilege escalation
Argument injection in the SSH login path can change the trusted RouterOS policy mask, enabling privilege escalation. Exploitation requires an unauthenticated SSH session that reaches the login helper (NVD / CERT.pl). Combined with CVE-2026-67279 in CERT.pl’s MikroTrick framing, successful chain abuse yields full administrative console access without password, SSH key, or completed authentication when SSH is reachable.
Related chain and adjacent CVEs
- CVE-2026-67279: SSH rekey/state flaw enabling unauthenticated session/exec reach—CERT.pl MikroTrick chain half; not in CISA KEV extract as of 2026-09-25; NVD Awaiting Analysis; CISA SSVC exploitation = poc.
- CVE-2026-67276: Incomplete public-key compare (SSH RSA); 7.x only; requires username + RSA modulus; CERT.pl: not suited for mass config-agnostic attack; not MikroTrick chain. NVD Awaiting Analysis; SSVC exploitation = none.
Primary sources reviewed (MikroTik, CERT.pl, CISA, CCCS, NVD) do not publish explicit MITRE ATT&CK technique ID mappings. This advisory does not invent ATT&CK IDs or actor attribution.
SSH internet exposure is the critical precondition for observed MikroTrick admin takeover (CERT.pl, CCCS, MikroTik). MikroTik notes default config blocks SSH from the internet; risk rises if SSH was manually opened. Prefer management via VPN (e.g. WireGuard); do not open management ports broadly.
Affected Product Versions
Vendor / product: MikroTik — RouterOS.
| Branch | Affected (as sourced) | Fixed |
|---|---|---|
| RouterOS 6.x | Prior to 6.49.21 (NVD/CCCS/CERT for 67277, 86060, 67279) | 6.49.21 |
| RouterOS 7.x Long-Term | Prior to 7.23.4 (from 7.0.0 for 67277/86060/67279) | 7.23.4 |
| RouterOS 7.x Stable | 7.24 prior to 7.24.2 | 7.24.2 |
| Development | Prior to 7.25 beta 3 | 7.25 beta 3 |
| CVE-2026-67276 only | 7.x only — from 7.9 below 7.23.4; 7.24 below 7.24.2. Not listed as affecting 6.x. | 7.23.4 / 7.24.2 |
Exposure notes: prioritize devices with SSH reachable from the internet or untrusted WAN (CCCS). Also restrict WWW/WWW-SSL and btest from untrusted addresses until patched (CERT.pl). Winbox/API internet exposure is a general hardening concern but was not the primary published MikroTrick vector in these sources.
Workaround and Mitigation
- Upgrade immediately to fixed builds: 6.49.21, 7.23.4, 7.24.2, or 7.25 beta 3 (MikroTik Check for updates / CCCS AL26-020). Verify version post-update.
- Keep SSH off untrusted networks; prefer VPN for management (MikroTik, CCCS).
- Until patched: restrict SSH, WWW/WWW-SSL, and bandwidth-test (btest) from untrusted addresses; do not use unpatched device built-in SSH clients toward untrusted hosts (CERT.pl).
- After upgrade: inspect for unknown scripts, users, and config; watch RouterOS Flagged critical log entries (MikroTik). Flagged absence does not prove clean (CERT.pl / vendor).
- Hunt published IoCs (IPs, -2 login failures, ops account creation, Flagged). If compromise suspected: isolate; preserve logs/config; factory reset and rebuild from trusted config; rotate secrets—do not blindly restore a full backup (CERT.pl).
- CISA KEV requiredAction: apply vendor mitigations; comply with BOD 26-04 and Forensics Triage Requirements; evaluate internet exposure; discontinue use if mitigations unavailable.
Note for patch baselines: CERT.pl also discusses CVE-2026-67278 with incomplete fix in some 7.23.4/7.24.2 contexts needing later builds (7.23.6 / 7.24.3) where TLS/X.509 issues matter—confirm org baselines if that CVE is in scope for your estate (out of KEV focus for this advisory).
Indicators of Compromise
Published by CERT.pl / vendor only. No exhaustive file hashes, YARA, or ATT&CK-mapped IoC packages in primary sources reviewed. Honest empty beyond the table below.
| Type | Indicator | Notes |
|---|---|---|
| IP | 82.192.72.4 | CERT.pl: origin of successful observed attacks incl. privileged ops creation since ≥ 2026-09-02 |
| IP | 103.102.31.18 | CERT.pl: used in attempts to exploit the chain |
| Log | login failure for user -2 from <ip> via ssh | Published artifact of chain abuse |
| Log | user <name> added by ssh:-2@<ip> | Account creation via abused path |
| Account | Privileged user ops (full group) | Vendor Flagged rule also watches for ops in full |
| Status | RouterOS Flagged | Startup scan disables known-bad config entries; absence ≠ clean |
| Behavior | Diagnostic/RIF file creation then fetch transfer toward attacker IP | Reported in public admin logs (CERT.pl summary); investigative lead, not sole proof |
Do not invent ATT&CK technique IDs or additional IoCs beyond vendor/CERT-published indicators.
References
- MikroTik: September 2026 vulnerability, 2026-09-03 — https://mikrotik.com/supportsec/september-2026-vulnerability
- CERT.pl: Vulnerabilities in MikroTik RouterOS actively exploited, 2026-09-05 — https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
- CERT.pl: MikroTik RouterOS CVE inventory, 2026-09-05 — https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
- CERT.pl: MikroTrick technical analysis, 2026-09-22 — https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/
- CISA: Adds Two Known Exploited Vulnerabilities to Catalog, 2026-09-10 — https://www.cisa.gov/news-events/alerts/2026/09/10/cisa-adds-two-known-exploited-vulnerabilities-catalog
- CISA KEV catalog / JSON — https://www.cisa.gov/known-exploited-vulnerabilities-catalog ; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- CCCS AL26-020, 2026-09-10 — https://www.cyber.gc.ca/en/alerts-advisories/al26-020-vulnerabilities-impacting-mikrotik-routeros-cve-2026-67276-cve-2026-67277-cve-2026-86060
- NVD: CVE-2026-67277 — https://nvd.nist.gov/vuln/detail/CVE-2026-67277
- NVD: CVE-2026-86060 — https://nvd.nist.gov/vuln/detail/CVE-2026-86060
- NVD: CVE-2026-67279 — https://nvd.nist.gov/vuln/detail/CVE-2026-67279
- NVD: CVE-2026-67276 — https://nvd.nist.gov/vuln/detail/CVE-2026-67276
Third-Party Risk Bridge: Edge and Branch MikroTik as MSP Control Plane
MikroTik RouterOS is common edge, branch, SOHO, and MSP CPE gear—site gateways and managed-network infrastructure, not only “IT endpoints.” CVE-2026-86060 (and CERT.pl’s MikroTrick chain with CVE-2026-67279) can yield full admin without completed authentication when SSH is reachable; CVE-2026-67277 abuses btest for disclosure/DoS. Pre-patch exploitation from September 2, 2026 and dual CISA KEV listing make RouterOS a TPRM inventory and patch-SLA ask: exact version (≥ 6.49.21 / 7.23.4 / 7.24.2), whether SSH/btest/WWW are internet-facing, Flagged / -2 / ops IoC hunts, and who owns ongoing update cadence for every third-party or MSP-managed device.
Book a demo to see how Rescana tracks edge CPE vendors for KEV exposure, version attestation, and management-plane evidence.
Forward this advisory to your TPRM owner if an MSP, colo, or branch provider operates MikroTik RouterOS for your estate—they own the patch-build, internet-SSH closure, and Flagged/IoC attestation asks above.
