Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws

Part of the MikroTik story · since 5 Sep

Quiet for 5 weekslast report 26 Sep18 articles7 outlets
5 Sep · SecurityOnline first6 Oct16 OctNowThis article12th of 18
  • Sat 5 Sep, 19:14 UTC. SecurityOnline, first report. MikroTik Patches Severe RouterOS Flaw Amid Global Attacks.
  • Sun 6 Sep, 10:01 UTC. The Hacker News, its first report on the story. Attackers Exploit MikroTik Routers for Unauthenticated Admin Access.
  • Sun 6 Sep, 14:36 UTC. Security Affairs, its first report on the story. MikroTik RouterOS Zero Day Chain Gives Attackers Admin Control.
  • Mon 7 Sep, 00:00 UTC. SANS ISC, its first report on the story. MikroTik Patches Exploited SSH Bypass That Adds Rogue Accounts.
  • Mon 7 Sep, 05:06 UTC. SecurityOnline. MikroTik RouterOS Attacks Exploit MikroTrick Flaws for Full Control.
  • Mon 7 Sep, 16:08 UTC. The Hacker News. Google Patches Chrome V8 Zero Day Exploited in Active Attacks. Cites a CVE in CISA KEV.
  • Tue 8 Sep, 11:01 UTC. Malwarebytes, its first report on the story. MikroTik Routers Face Takeover Risk From Active MikroTrick Attacks.
  • Tue 8 Sep, 11:31 UTC. SecurityWeek, its first report on the story. MikroTik Patches Exploited RouterOS Flaws in MikrTrick Attack Chain.
  • Thu 10 Sep, 21:32 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Critical MikroTik RouterOS Flaw. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 21:32 UTC. CISA. CISA Flags Actively Exploited MikroTik RouterOS Flaw Exposing Kernels. Cites a CVE in CISA KEV.
  • Sat 12 Sep, 17:53 UTC. The Hacker News. CISA Flags Artifactory, ScreenConnect and RouterOS Attacks. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV. This article, 12th of 18.
  • Wed 23 Sep, 17:00 UTC. The Hacker News. MikroTrick Chain Lets Attackers Hijack MikroTik Routers Without Credentials.
  • Thu 24 Sep, 19:38 UTC. Security Affairs. MikroTik Routers Hacked Using Dual Flaws to Bypass Passwords. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 16:01 UTC. CISA. Actively Exploited MikroTik RouterOS Flaw Enables Unauthenticated Attacks. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 17:00 UTC. CISA. CISA Flags Actively Exploited SharePoint and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 21:31 UTC. Security Affairs. CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 10:11 UTC. The Hacker News. Attackers Exploit Critical SharePoint and MikroTik RouterOS Flaws.

Between 7 and 13 September 2026, the tracker recorded 3,856 new CVEs, including 318 rated critical and 1,703 rated high. Daily Cybersecurity identified 19 as exploited; 10 were later added to CISA’s Known Exploited Vulnerabilities (KEV) catalogue, while nine were not listed at the time of comparison. The feed reported three shared vulnerabilities before CISA, by between one and three days, although the article cautions that the dates measure different events and are not a controlled benchmark.

CISA separately added four exploited flaws that the feed had not flagged, including CVE-2026-84869 in ConnectWise ScreenConnect and CVE-2026-19490 in Citrix NetScaler.

The most serious highlighted cases include CVE-2026-86218, a CVSS 10.0 unauthenticated code-injection flaw in N-able N-central. N-able said it had been exploited in the wild, while Shadowserver counted nearly 1,500 internet-facing servers. CERT Polska reported active exploitation of the MikroTik RouterOS “MikroTrick” SSH chain, which combines CVE-2026-67276 and CVE-2026-86060 to obtain full control without credentials; more than 122,500 internet-facing RouterOS SSH instances were observed in one scan.

GitLab’s CVE-2026-85706, also rated 10.0, permits unauthenticated reading of files through a path-traversal flaw, with probes reportedly seen from 11 September.

The article recommends prioritising patches for internet-facing systems, including N-central 2026.3.1.14, GitLab 19.1.8, 19.2.6 or 19.3.2, and MikroTik RouterOS 6.49.21, 7.23.4 or 7.24.2. It also advises treating SSH-exposed MikroTik devices as potentially compromised and restricting management interfaces where immediate patching is not possible.

How the story developed

All 18 articles
Quiet for 5 weekslast report 26 Sep18 articles7 outlets

18 articles from 7 outlets since 5 Sep. Quiet since 26 Sep. This was the 12th report, 8 days after the first.

Now5 Sep9111315171921232527First reportSecurityOnline · 5 Sep, 19:14This article12th of 18 · day 9
  • Sat 5 Sep, 19:14 UTC. SecurityOnline, first report. MikroTik Patches Severe RouterOS Flaw Amid Global Attacks.
  • Sun 6 Sep, 10:01 UTC. The Hacker News, its first report on the story. Attackers Exploit MikroTik Routers for Unauthenticated Admin Access.
  • Sun 6 Sep, 14:36 UTC. Security Affairs, its first report on the story. MikroTik RouterOS Zero Day Chain Gives Attackers Admin Control.
  • Mon 7 Sep, 00:00 UTC. SANS ISC, its first report on the story. MikroTik Patches Exploited SSH Bypass That Adds Rogue Accounts.
  • Mon 7 Sep, 05:06 UTC. SecurityOnline. MikroTik RouterOS Attacks Exploit MikroTrick Flaws for Full Control.
  • Mon 7 Sep, 16:08 UTC. The Hacker News. Google Patches Chrome V8 Zero Day Exploited in Active Attacks. Cites a CVE in CISA KEV.
  • Tue 8 Sep, 11:01 UTC. Malwarebytes, its first report on the story. MikroTik Routers Face Takeover Risk From Active MikroTrick Attacks.
  • Tue 8 Sep, 11:31 UTC. SecurityWeek, its first report on the story. MikroTik Patches Exploited RouterOS Flaws in MikrTrick Attack Chain.
  • Thu 10 Sep, 21:32 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Critical MikroTik RouterOS Flaw. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 21:32 UTC. CISA. CISA Flags Actively Exploited MikroTik RouterOS Flaw Exposing Kernels. Cites a CVE in CISA KEV.
  • Sat 12 Sep, 17:53 UTC. The Hacker News. CISA Flags Artifactory, ScreenConnect and RouterOS Attacks. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV. This article, 12th of 18.
  • Wed 23 Sep, 17:00 UTC. The Hacker News. MikroTrick Chain Lets Attackers Hijack MikroTik Routers Without Credentials.
  • Thu 24 Sep, 19:38 UTC. Security Affairs. MikroTik Routers Hacked Using Dual Flaws to Bypass Passwords. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 16:01 UTC. CISA. Actively Exploited MikroTik RouterOS Flaw Enables Unauthenticated Attacks. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 17:00 UTC. CISA. CISA Flags Actively Exploited SharePoint and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 21:31 UTC. Security Affairs. CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 10:11 UTC. The Hacker News. Attackers Exploit Critical SharePoint and MikroTik RouterOS Flaws.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 18 articles as a list
  1. Sat 5 SepDay 01
    1. MikroTik Patches Severe RouterOS Flaw Amid Global Attacks19:14 · SecurityOnline · First report
  2. Sun 6 SepDay 12
    1. Attackers Exploit MikroTik Routers for Unauthenticated Admin Access10:01 · The Hacker News
    2. MikroTik RouterOS Zero Day Chain Gives Attackers Admin Control14:36 · Security Affairs
  3. Mon 7 SepDay 23
    1. MikroTik Patches Exploited SSH Bypass That Adds Rogue Accounts00:00 · SANS ISC
    2. MikroTik RouterOS Attacks Exploit MikroTrick Flaws for Full Control05:06 · SecurityOnline
    3. Google Patches Chrome V8 Zero Day Exploited in Active Attacks16:08 · The Hacker News · Exploited CVE · Known exploited CVE
  4. Tue 8 SepDay 32
    1. MikroTik Routers Face Takeover Risk From Active MikroTrick Attacks11:01 · Malwarebytes
    2. MikroTik Patches Exploited RouterOS Flaws in MikrTrick Attack Chain11:31 · SecurityWeek

  5. Quiet for 2 days

    Thu 10 SepDay 52
    1. CISA Flags Actively Exploited Critical MikroTik RouterOS Flaw21:32 · CISA · official · CISA alert · Picked up again · Known exploited CVE
    2. CISA Flags Actively Exploited MikroTik RouterOS Flaw Exposing Kernels21:32 · CISA · official · Known exploited CVE

  6. Quiet for 2 days

    Sat 12 SepDay 71
    1. CISA Flags Artifactory, ScreenConnect and RouterOS Attacks17:53 · The Hacker News · Known exploited CVE
  7. Mon 14 SepDay 91
    1. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws03:11 · SecurityOnline · Known exploited CVE · This article, 12th of 18

  8. Quiet for 10 days

    Wed 23 SepDay 181
    1. MikroTrick Chain Lets Attackers Hijack MikroTik Routers Without Credentials17:00 · The Hacker News · Picked up again
  9. Thu 24 SepDay 191
    1. MikroTik Routers Hacked Using Dual Flaws to Bypass Passwords19:38 · Security Affairs · Known exploited CVE
  10. Fri 25 SepDay 203
    1. Actively Exploited MikroTik RouterOS Flaw Enables Unauthenticated Attacks16:01 · CISA · official · Known exploited CVE
    2. CISA Flags Actively Exploited SharePoint and MikroTik Flaws17:00 · CISA · official · Known exploited CVE
    3. CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw21:31 · Security Affairs · Known exploited CVE
  11. Sat 26 SepDay 211
    1. Attackers Exploit Critical SharePoint and MikroTik RouterOS Flaws10:11 · The Hacker News

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in