Exploitation observed; activity peaked at 20 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-09-05 | 2 | Active Exploitation1Disclosure1 |
| 2026-09-06 | 10 | Active Exploitation4Disclosure1Exploit1Patch1PoC3 |
| 2026-09-07 | 20 | Active Exploitation11Disclosure3General2Patch2PoC2 |
| 2026-09-08 | 8 | Active Exploitation6Disclosure1Exploit1 |
| 2026-09-09 | 5 | Active Exploitation4Disclosure1 |
| 2026-09-10 | 5 | Active Exploitation1Patch3PoC1 |
| 2026-09-11 | 4 | Active Exploitation3General1 |
| 2026-09-12 | 1 | Active Exploitation1 |
| 2026-09-13 | 1 | Active Exploitation1 |
| 2026-09-14 | 2 | Active Exploitation2 |
| 2026-09-15 | 1 | Disclosure1 |
| 2026-09-17 | 4 | Active Exploitation2False Positive1 |
| 2026-09-18 | 3 | Active Exploitation1Disclosure2 |
| 2026-09-19 | 1 | Disclosure1 |
| 2026-09-21 | 1 | Disclosure1 |
| 2026-09-23 | 2 | Active Exploitation1General1 |
| 2026-09-25 | 2 | Active Exploitation1Patch1 |
| 2026-09-29 | 1 | Active Exploitation1 |
| 2026-10-02 | 1 | Active Exploitation1 |
MikroTrick lab PoC — CVE-2026-67276 (RouterOS SSH public-key auth bypass) https://github.com/dinosn/mikrotrick-poc
Post summary
A proof‑of‑concept for CVE‑2026‑67276, which allows bypassing SSH public‑key authentication on MikroTik RouterOS, has been published on GitHub.
🧨🧨🧨 MIKROTRICK 🧨🧨🧨 Weaponized MikroTik RouterOS exploitation framework. - CVE-2026-67279 - CVE-2026-86060 - CVE-2026-67276 - CVE-2026-67281 - CVE-2026-67277 - CVE-2026-67278 - CVE-2025-61481 - CVE-2025-10948 - CVE-2018-14847 Now available at my beloved ❤️ https://gibliz.taile5d4a8.ts.net/0days/ #exploit #rce #vulnerabilities #cve #0days #mikrotik #router #cybersecurity #infosec #antisec #linux
Post summary
The post announces a weaponized MikroTik RouterOS exploitation framework listing several CVEs and provides a link to the code, suggesting a ready-to-use exploit tool.
It took us 3 hours to rewrite the full pre-auth RCE MikroTrick chain (CVE-2026-67279, CVE-2026-86060, CVE-2026-67276) from the public advisory. https://open.substack.com/pub/tolmo/p/pre-auth-rce-on-mikrotik-exploited?r=9tyic&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true
Post summary
The post announces that the authors have recreated the complete pre-authentication Remote Code Execution exploitation chain for three MikroTrick CVEs, providing a new proof of concept via a Substack link.
🚨 Upozorňujeme na kritické zranitelnosti v RouterOS v zařízeních MikroTik, CVE-2026-67277, CVE-2026-86060, CVE-2026-67276. Zranitelnosti umožňují vzdálené spuštění kódu s administrátorskými oprávněními prostřednictvím služby SSH, přičemž exploit zcela obchází všechny autentizační mechanismy. Zneužití spočívá v odeslání požadavku na ověření s uživatelským jménem „-2“, otevření kanálu relace a vyžádání PTY, kde lze vložením masky zásad RouterOS dosáhnout spuštění kódu s plnými oprávněními bez použití hesla, klíče, podpisu ani jiných přihlašovacích údajů. Aktuálně dochází k masovému zneužívání těchto zranitelností a útočníci po kompromitaci upravují konfiguraci zařízení tak, aby si zajistili trvalý přístup přetrvávající i po aktualizaci firmware. Prvotní zneužití může vytvářet log „login failure for user -2“, další aktivity však nemusí být v logách spolehlivě zaznamenány. Doporučená nápravná opatření zahrnují aktualizaci firmware, kompletní revizi konfigurace, ověření známek kompromitace, zvážení omezení SSH z veřejného internetu a v některých případech i kompletní reinstalaci zařízení. Více informací lze také nalézt na našem Portále, odkaz naleznete v komentáři pod příspěvkem. 📌Doporučujeme zařízení MikroTik aktualizovat na nejnovější verzi.
Post summary
The post alerts that several RouterOS CVEs allow remote code execution via SSH authentication bypass, with large-scale active exploitation reported, and urges immediate firmware updates and configuration audits.
- CVE-2026-86060 — Escalada de privilegios vía manejo de argumentos en el proceso de login SSH (sesión SSH no autenticada). - CVE-2026-67281 — Lectura de ficheros sin autenticación en WebFig (/jsproxy), con posible exposición de ficheros de configuración y credenciales. - CVE-2026-67279 — Ejecución de peticiones exec por SSH sin autenticación previa, permitiendo creación y sobrescritura de ficheros gestionados por RouterOS. - CVE-2026-67278 — Aceptación de firmas RSA/PKCS#1 v1.5 malformadas en la validación X.509, habilitando suplantación de servidores TLS. - CVE-2026-67277 — Sesiones btest "related" sin autenticación completada, con fuga de memoria de buffers de kernel y posible reinicio del equipo (denegación de servicio). - CVE-2026-67276 — Comparación incompleta de clave pública RSA en autenticación SSH, permitiendo autenticarse como un usuario autorizado sin disponer de su clave privada.
Post summary
The text announces six new CVEs, providing concise descriptions of various vulnerabilities such as privilege escalation and authentication bypass, but it does not include PoCs, exploit code, active exploitation evidence, or patch information.
🚨Alert🚨CVE-2026-67276 (CVSS: 9.2): MikroTrik SSH Authentication Bypass. It affects only 7.x branch. 📊 10.4M+ Services are found on the http://hunter.how yearly. 🔥PoC :https://github.com/BlackHatExploitation/exploit-mikrotik-2026 🔗Hunter Link:https://hunter.how/list?searchValue=product.name%3D%22MikroTik%20RouterOS%22 HUNTER : http://product.name="MikroTik RouterOS" 📰Refer:https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ #hunterhow #infosec #infosecurity #OSINT #Vulnerability
Post summary
CVE‑2026‑67276 is a severe SSH authentication bypass in MikroTik RouterOS 7.x, with a publicly released PoC and evidence of active exploitation in the wild, though no patch or mitigation details are provided.
SSH Authentication Vulnerability in MikroTik RouterOS CVE-2026-67276 | Severity: CRITICAL https://github.com/dinosn/mikrotrick-poc
Post summary
The post announces a critical SSH authentication flaw in MikroTik RouterOS and provides a GitHub link to a PoC demonstrating the vulnerability.
🚨 MIKROTIK “MIKROTRICK”: UNAUTH SSH CHAIN TO FULL ADMIN — EXPLOITED BEFORE PATCHES CERT Polska published a 22 Sep 2026 technical analysis of MikroTrick, the unauthenticated MikroTik RouterOS SSH takeover chain combining CVE-2026-67279 (rekey state-machine flaw) with CVE-2026-86060 (username “-2” / login argv injection) for full admin without password or SSH key. • Patches: RouterOS 6.49.21, 7.23.4, 7.24.2, 7.25beta3 (vendor released ~3 Sep 2026) • CERT Polska says logs matching the chain (failed login for user -2, privileged “ops” account) appeared as early as 2 Sep — before patches • Distinctive IoCs: login failure for user -2; creation of fully privileged ops; connections from 82.192.72.4 in public reports; Flagged/device-mode checks after update • CVE-2026-86060 added to CISA KEV (10 Sep) with short remediation window • CERT incorrectly notes some coverage mixed in CVE-2026-67276 (separate RSA-forge path) — MikroTrick is the 67279+86060 pair • Immediate: patch, restrict public SSH, hunt -2 / ops / unknown config changes per MikroTik security bulletin ⚠️ Analyst Note: Primary is CERT Polska’s own technical write-up (not The Hacker News / Telegram CTI). Exploitation evidence is from CERT coordination plus public admin logs; treat as confirmed vulnerable-device attacks against internet-exposed SSH, not a new zero-day today. We assess MikroTrick as a confirmed, previously exploited RouterOS admin-takeover chain — patch and hunt now if not already done. Primary (CERT Polska, 22 Sep 2026): https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/ Also: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ #DDW #MikroTik #MikroTrick #RouterOS #KEV #ThreatIntelligence #CyberSecurity
Post summary
MikroTrick (CVE-2026-67279 + CVE-2026-86060) is confirmed as actively exploited in the wild prior to patch deployment, with CISA KEV listing and CERT logs dating exploitation to 2 Sep 2026, prompting immediate patching and SSH restriction.
MikroTrick lab PoC — CVE-2026-67276 (RouterOS SSH public-key auth bypass) https://github.com/dinosn/mikrotrick-poc
Post summary
A proof‑of‑concept for CVE-2026-67276, an SSH public‑key authentication bypass in MikroTik RouterOS, has been published with code available on GitHub.
MikroTrick: vulnerabilidad crítica de omisión de autenticación SSH en MikroTik RouterOS (CVE-2026-67276) https://blog.segu-info.com.ar/2026/09/mikrotrick-vulnerabilidad-critica-de.html
Post summary
The post announces a critical SSH authentication bypass vulnerability in MikroTik RouterOS (CVE-2026-67276) without providing exploitation details, patches, or evidence of active use.
Internet-facing MikroTik SSH can still mean a full router takeover. CISA just added two MikroTrick bugs to the federal must-patch list, due Sep 13. https://hol.org/blog/cve-2026-67276-mikrotik-routeros-mikrotrick-ssh-cluster https://t.co/a5BTvhb0f8
Post summary
The tweet highlights that MikroTik SSH remains a critical vulnerability, prompting CISA to list the CVEs on the federal must‑patch schedule.
Anyone who can reach your MikroTik's public SSH can open a session without logging in. CISA put that SSH rekey bug on the federal must-patch list today, due Sep 28. https://hol.org/blog/cve-2026-67276-mikrotik-routeros-mikrotrick-ssh-cluster https://t.co/XrGVN53ue2
Post summary
The text reports that CISA has added CVE-2026-67276, a MikroTik RouterOS SSH authentication bypass, to its Known Exploited Vulnerabilities list, confirming active exploitation and requiring urgent patching by September 28.
Your MikroTik can be taken over if SSH is reachable from the internet. CERT Polska says attackers are already chaining these bugs (MikroTrick). Six CVEs dropped today, lead CVE-2026-67276. Patch RouterOS now. https://hol.org/blog/cve-2026-67276-mikrotik-routeros-mikrotrick-ssh-cluster https://t.co/UML7ZMb3Ef
Post summary
MikroTik devices are vulnerable to takeover if SSH is exposed; attackers are actively chaining these six CVEs (lead CVE-2026-67276), but a patch for RouterOS has already been released.
CVE-2026-67276 and others: MikroTik RouterOS vulnerabilities exploited in the wild (MikroTrick), up to 9.2 rating 🔥 Recently disclosed vulnerabilities in MikroTik RouterOS allow an attacker to take full control of the device without authentication if the device supports remote access via the SSH protocol. These vulnerabilities are being actively exploited in the wild! 👉 https://nt.ls/318sx
Post summary
MikroTik RouterOS vulnerabilities (including CVE‑2026‑67276) are actively being exploited in the wild, enabling attackers to gain unauthenticated full control through SSH.
@Akademik_ufa Недавно CVE-2026-67276 всплыла, скорее всего она
"MikroTrick": two chained MikroTik RouterOS flaws let attackers skip authentication entirely and land straight at full admin control. CVE-2026-67276 bypasses SSH auth via incomplete RSA key validation. CVE-2026-86060 then escalates to full administrative privileges via a crafted username. CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10 — even though it still carries no CVSS score. Active exploitation doesn't wait for a number. Patch now. Details: http://vulntracker.io/cves/CVE-2026-86060 Full breakdown on our blog: https://vulntracker.io/blog/mikrotik-routeros-under-active-attack-cve-2026-86060 #MikroTik #RouterOS #CVE #CISA #VulnTracker
Post summary
The post confirms that MikroTik RouterOS vulnerabilities CVE-2026-67276 and CVE-2026-86060 are actively exploited in the wild, as evidenced by CISA’s KEV listing, and it notes that a patch is available.
⚠️ #ALERTE - @MLCERT Des #routeurs sont massivement exploités ! MikroTik (CVE-2026-67276/86060) etc.... Mettez à jour VOS routeurs ! Vérifiez la version de votre firmware & appliquez les correctifs. Un routeur compromis = porte ouverte à un ransomware ! #CYBERSECURITE https://t.co/rPfoEnShWp
Post summary
The alert states that MikroTik routers are being actively exploited and urges users to update firmware and apply patches to prevent potential ransomware attacks.
Miło mi, że znalezione przeze mnie podatności zostały przytoczone w Waszym raporcie. Niestety media często wskazują błędnie CVE-2026-67276 jako składnik łańcucha #Mikrotrick
Post summary
The author expresses satisfaction that their discovered vulnerabilities are cited in a report but corrects the media for erroneously including CVE-2026-67276 in the #Mikrotrick chain.
🚨 CVE-2026-86060 — MikroTik RouterOS, SSH privilege escalation (MikroTrick chain) What broke: CERT Polska’s MikroTrick is a two-bug chain. CVE-2026-67276 is an SSH auth bypass (incomplete RSA public-key check). This CVE, 86060, is the escalator: a crafted username can turn that session into full admin. Together, on a box with SSH reachable, that is device takeover without a valid password. 86060 is not a standalone internet worm — it needs an unauthenticated SSH session at the login helper. Who should care: RouterOS with SSH on the internet or another untrusted network, before 6.49.21 / 7.23.4 / 7.24.2 (or 7.25beta3). Default config blocks WAN SSH; the exposed fleet is the problem. Shadowserver saw 122,500+ MikroTik SSH listeners on 5 Sept — reachable SSH, not a vuln census. Status: exploited from at least 2 Sept, one day before MikroTik’s 3 Sept fixes and three days before the 5 Sept writeup. CISA put 86060 and related 67277 on KEV on 10 Sept (due 13 Sept). The entry-point CVE-2026-67276 is still not on KEV. Don’t treat “the two KEV IDs are patched” as the whole chain. Fix: 6.49.21 (v6 long-term), 7.23.4 (long-term), or 7.24.2 (stable). The build adds a startup Flagged check for known bad config. CERT is explicit: no Flagged warning is not a clean bill of health. If you can’t patch: pull SSH off the internet; manage over VPN. If SSH was ever public, hunt for “ops” and unknown admins before you call it done. Source: CERT Polska / MikroTik Sept 2026 advisory / CISA KEV #MikroTik #RouterOS
Post summary
CVE‑2026‑86060 is an actively exploited SSH privilege‑escalation chain (CVE‑2026‑67276) that enables full device takeover without a valid password; patches are available and CISA has added it to the KEV list.
#CyberAlert | AL26-020 - Vulnerabilities Impacting MikroTik RouterOS Organizations using MikroTik RouterOS should update affected devices immediately and review vendor guidance. https://www.cyber.gc.ca/en/alerts-advisories/al26-020-vulnerabilities-impacting-mikrotik-routeros-cve-2026-67276-cve-2026-67277-cve-2026-86060 https://t.co/hnCcR90DJi
Post summary
The alert warns MikroTik RouterOS users of CVE-2026-67276, 2026-67277, and 2026-86060, urging prompt patching and vendor guidance review, with no mention of PoC, exploitation, or mitigation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | mikrotik | routeros | - | - | - |