CERT Polska reports that attacks against internet-facing MikroTik RouterOS devices began in early September 2026, with attackers chaining a pair of flaws—collectively dubbed MikroTrick—to gain full administrative control over SSH without a password. The chain combines CVE-2026-67276, an SSH public-key authentication bypass, with CVE-2026-86060, which escalates privileges via a crafted SSH username.
Public PoC exploit code has since appeared, and attackers have been observed creating highly privileged accounts (notably an account named “ops”) on compromised devices. While CERT Polska states there is real exploitation of this combination, several related flaws in the same set remain unpatched on many systems.
The vulnerability set spans a wide range of RouterOS builds across the 6.x and 7.x lines. MikroTik has issued fixes in versions including 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, with the vendor also sending a push notification to users of the MikroTik mobile app.
In addition to the two primary chain flaws, CERT Polska lists four extra vulnerabilities in the same family: CVE-2026-67279 (unauthenticated file operations after an SSH rekey), CVE-2026-67281 (unauthenticated WebFig file read), CVE-2026-67277 (btest/kernel restart via a crafted connection), and CVE-2026-67278 (TLS server impersonation).
The recommended response is immediate patching to fixed releases, followed by log review for compromise indicators, isolation of any flagged devices, and restricted exposure if patching cannot be completed promptly.