CVE-2026-67276: MikroTik RouterOS SSH Zero-Day Exploited in Router Takeover Attacks

MikroTik has released emergency RouterOS security updates after researchers confirmed that attackers are actively exploiting a high-severity SSH authentication bypass against internet-facing routers. Tracked as CVE-2026-67276 and rated 9.2 on the CVSS scale, the flaw allows an attacker to authenticate as an existing RouterOS user without possessing that user’s legitimate RSA private key.

The vulnerability becomes significantly more dangerous when combined with CVE-2026-86060, a separate SSH privilege-escalation weakness. CERT Polska has named the two-stage attack chain MikroTrick and confirmed that attackers are using it to obtain full administrative control of RouterOS devices whose SSH service is reachable from public networks.

Evidence indicates that exploitation began as early as September 2, 2026, one day before MikroTik publicly released patched RouterOS builds on September 3. Successful attacks have created highly privileged accounts, modified device configuration, and established access that may survive until administrators actively investigate and rebuild compromised systems.

The broader group of MikroTrick Flaws disclosed by CERT Polska includes six RouterOS vulnerabilities affecting SSH server and client functionality, the bandwidth-test service, X.509 certificate validation, and the WebFig management interface. However, CVE-2026-67276 and CVE-2026-86060 form the combination currently confirmed in active full-device takeover attacks.

CVE-2026-67276 analysis

The vulnerability originates in the way RouterOS validates RSA public keys during SSH authentication. RouterOS did not compare the complete public key associated with an authorized user. Instead, only part of the RSA key was sufficiently validated, allowing a specially constructed alternative key to be accepted under conditions where it should have been rejected.

The most important details for CVE-2026-67276 are that an attacker needs to know a valid RouterOS username and the public modulus associated with that user’s authorized RSA SSH key. The attacker can then construct another key that passes the vulnerable validation process and authenticate without possessing the corresponding private key.

Successful exploitation of this flaw alone gives the attacker the same RouterOS permissions assigned to the impersonated account. If the targeted user already has administrative rights, that may directly provide significant control over the device. When the user’s permissions are more limited, attackers can combine the flaw with CVE-2026-86060 to escalate further.

CVE-2026-86060 stems from improper handling of specially crafted SSH usernames beginning with a prohibited character. The flaw allows manipulation of the RouterOS policy mask associated with the SSH session, enabling privilege escalation to full administrative rights. CERT Polska confirms that exploiting the two weaknesses together enables unauthenticated takeover of a RouterOS device when SSH is exposed.

This chain is especially important because it removes the usual requirement to steal a valid administrator password or private SSH key. An external actor capable of reaching the SSH service may be able to move from crafted authentication attempts to a privileged RouterOS session and then perform administrative operations.

Attempts to exploit MikroTik RouterOS in observed attacks have focused on devices exposing SSH directly to the internet. MikroTik notes that default home configurations are generally not immediately exposed, but administrators who have enabled public SSH or changed firewall rules may face substantially greater risk.

CVE-2026-67276 affects the following RouterOS release ranges:

• RouterOS 7.24 through versions before 7.24.2
• RouterOS 7.0.0 through versions before 7.23.4
• RouterOS 6.0.0 through versions before 6.49.21

CERT Polska categorized the vulnerability as CWE-347: Improper Verification of Cryptographic Signature. All six RouterOS security issues disclosed in the same research share the same broad affected release ranges.

The vulnerability was discovered by CERT Polska as part of security research performed in coordination with MikroTik. Researchers used an agent-based laboratory environment supported by AI models to analyze RouterOS components, compare software versions, model protocol states, and validate hypotheses against real test systems. Each finding was subsequently confirmed manually and through repeat testing before disclosure.

The precise private discovery date has not been published. MikroTik released the security fixes on September 3, 2026, while CERT Polska published technical information and the assigned CVEs on September 5. Real-world evidence indicates that attackers were already exploiting the chain by September 2, giving the campaign zero-day characteristics.

Researchers have confirmed successful attacks originating from 82.192.72[.]4, with exploitation attempts also associated with 103.102.31[.]18. Observed compromises created a highly privileged RouterOS user named ops.

Security Affairs also reported infrastructure at 82.192.72[.]4 hosting a MIPS BusyBox binary and files named ftpsrv.py, launch.sh, and serve.py. The available evidence has not yet tied the activity to a named threat group or established whether the compromised routers are being assembled into a botnet, proxy network, espionage infrastructure, or another operation.

The observed attack chain leaves particularly useful artifacts in RouterOS logs and configuration history. Failed exploitation attempts can generate entries resembling:

login failure for user -2 from <ip> via ssh

Successful activity may subsequently appear as:

user <name> added by ssh:-2@<ip>

The string -2 is especially suspicious because it is not a normal RouterOS username and has been associated with exploitation of the privilege-manipulation stage.

A public CVE-2026-67276 PoC has now appeared for controlled laboratory testing of the SSH authentication weakness. Its availability further lowers the barrier for independent reproduction of the flaw, reinforcing the need to patch before scanning and exploitation become more widespread.

Useful CVE-2026-67276 IOCs currently include the two observed source IP addresses, the abnormal -2 SSH username, the ops account, and configuration changes attributed to ssh:-2@<IP>. Security Affairs additionally published hashes for several files recovered from associated attacker infrastructure.

CVE-2026-67276 Mitigation

MikroTik and CERT Polska recommend upgrading RouterOS immediately. Fixes are available in:

• RouterOS 7.25 beta 3 or later
• RouterOS 7.24.2 or later
• RouterOS 7.23.4 or later
• RouterOS 6.49.21 or later

MikroTik subsequently released RouterOS 7.23.5 after an IPv6 DHCP regression was discovered in 7.23.4. Organizations using the long-term 7.23 branch should therefore use the latest available maintenance build rather than intentionally stopping at 7.23.4.

After updating, RouterOS performs a startup check for selected known indicators of unauthorized configuration changes. If suspicious modifications are identified, the device is assigned a Flagged status, the relevant configuration entries can be disabled, and a critical warning is written to the system log.

Administrators can inspect this state with:

/system/device-mode/print

A Flagged result should be treated as evidence that the device may have been compromised. However, both MikroTik and CERT Polska emphasize that the absence of the Flagged marker does not prove that a router is clean, because the mechanism only detects selected known artifacts.

CVE-2026-67276 detection should therefore combine patch verification with log review, configuration inspection, and analysis of recently created accounts and administrative changes.

To Detect CVE-2026-67276 exploitation or related MikroTrick activity, defenders should look for:

• login failure for user -2 … via ssh
• Administrative actions attributed to ssh:-2@<IP>
• An unexpected privileged account named ops
• Connections involving 82.192.72[.]4
• Connections involving 103.102.31[.]18
• Newly added or modified SSH public keys
• Unknown users or changed user permissions
• Unexpected RouterOS scripts
• Suspicious scheduler tasks
• Newly enabled proxies or tunnels
• Unexplained firewall or NAT modifications
• Packet-sniffing or traffic-forwarding configuration that administrators did not create
• Other unexpected configuration ch

Key Takeaways

• CVE-2026-67276 is a high-severity SSH authentication bypass in MikroTik RouterOS, rated 9.2, allowing attackers to authenticate as any existing user without the legitimate RSA private key.
• When combined with CVE-2026-86060, the attack chain named MikroTrick gives attackers full administrative control over internet-facing RouterOS devices.
• Exploitation began as early as September 2, 2026, one day before MikroTik released patched builds, and has led to persistent compromise with modified configurations.