Threat Overview
CERT Polska disclosed six MikroTik RouterOS vulnerabilities and confirmed active attacks against Internet-accessible devices. The most serious chain, named MikroTrick, combines CVE-2026-67276, an SSH public-key authentication bypass, with CVE-2026-86060, an SSH session privilege-manipulation flaw. CERT Polska states that attackers are using the combination to obtain full control of RouterOS devices whose SSH service is reachable from public networks. MikroTik released fixes on September 3, 2026 and added a post-upgrade “Flagged” mechanism intended to identify signs of compromise.
References
- CERT Polska active-exploitation advisory, September 5, 2026: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ – CERT Polska technical vulnerability details, September 5, 2026: https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/ – MikroTik security bulletin, September 3, 2026: https://mikrotik.com/supportsec/september-2026-vulnerability/ – BleepingComputer, September 7, 2026: https://www.bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/
Impacted Systems
Vendor/product: MikroTik RouterOS. Primary exploited exposure: RouterOS devices with SSH reachable from the Internet. CVE-2026-67276 affects SSH public-key authentication; exploitation requires knowledge of a username and the public modulus of that user’s RSA key. CVE-2026-86060 abuses crafted usernames in the SSH login path to alter the RouterOS policy mask and obtain full administrative privileges. CERT Polska also disclosed CVE-2026-67277 affecting the bandwidth-test service, which can permit unauthenticated kernel-memory disclosure or remote denial of service. Fixed releases: 7.25beta3, 7.24.2, 7.23.4, and 6.49.21.
Why this matters
This is confirmed active exploitation of Internet-facing network infrastructure. A compromised router can provide persistent traffic interception, proxying, tunneling, credential theft opportunities, and a staging point for attacks against internal systems.
Criticality: Critical
Exploitation Status
Confirmed active exploitation. CERT Polska states that it observed attacks against publicly accessible RouterOS devices and confirmed that attackers are exploiting the vulnerability combination to take full control of affected systems.
What this hunt looks for
Available Microsoft Sentinel telemetry can be reviewed for inbound Internet SSH connections to RouterOS devices, unusual SSH source addresses, RouterOS login and configuration-change syslog events, creation of unexpected users/scripts/scheduler entries, and proxy or tunneling configuration changes where those data sources are ingested.
Required logs
- CommonSecurityLog from perimeter firewalls or network devices for connections to RouterOS management services
- Syslog from MikroTik RouterOS devices for authentication and configuration-change hunting
First Pass – Internet SSH Connections to MikroTik Devices
let MikroTikIPs = dynamic(["REPLACE_WITH_MIKROTIK_PUBLIC_IP"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationIP in (MikroTikIPs)
| where DestinationPort == 22
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP
| order by Connections descNew SSH Sources to MikroTik Devices
let MikroTikIPs = dynamic(["REPLACE_WITH_MIKROTIK_PUBLIC_IP"]);
let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(2d))
| where DestinationIP in (MikroTikIPs)
| where DestinationPort == 22
| summarize by SourceIP;
CommonSecurityLog
| where TimeGenerated > ago(2d)
| where DestinationIP in (MikroTikIPs)
| where DestinationPort == 22
| where SourceIP !in (Baseline)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP
| order by FirstSeen descRouterOS SSH Authentication Activity in Syslog
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("ssh","logged in","login failure","authentication")
| project TimeGenerated, Computer, Facility, SeverityLevel, ProcessName, SyslogMessage
| order by TimeGenerated descRouterOS User and Privilege Configuration Changes
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("user","group","policy","password","ssh")
| where SyslogMessage has_any ("added","changed","set","created","enabled","disabled","removed")
| project TimeGenerated, Computer, Facility, SeverityLevel, ProcessName, SyslogMessage
| order by TimeGenerated descRouterOS Script and Scheduler Changes
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("script","scheduler")
| where SyslogMessage has_any ("added","changed","created","enabled","set","run")
| project TimeGenerated, Computer, Facility, SeverityLevel, ProcessName, SyslogMessage
| order by TimeGenerated descRouterOS Proxy, SOCKS, Tunnel, and VPN Configuration Changes
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("proxy","socks","tunnel","eoip","gre","wireguard","l2tp","sstp","pptp","ipsec")
| where SyslogMessage has_any ("added","changed","created","enabled","set","connected")
| project TimeGenerated, Computer, Facility, SeverityLevel, ProcessName, SyslogMessage
| order by TimeGenerated descRouterOS High-Severity or Critical Events After Upgrade
Syslog
| where TimeGenerated > ago(14d)
| where SeverityLevel in~ ("critical","alert","emergency") or SyslogMessage has_any ("Flagged","critical","compromised")
| project TimeGenerated, Computer, Facility, SeverityLevel, ProcessName, SyslogMessage
| order by TimeGenerated descExternal Management Connections to MikroTik Services Beyond SSH
let MikroTikIPs = dynamic(["REPLACE_WITH_MIKROTIK_PUBLIC_IP"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationIP in (MikroTikIPs)
| where DestinationPort in (22,80,443,8291,8728,8729)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Ports=make_set(DestinationPort,20), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP
| order by Connections descDetection Notes
Highest signal is a new or unexpected Internet source reaching SSH on a MikroTik device followed by RouterOS user, script, scheduler, proxy, or tunnel configuration changes. RouterOS syslog wording can vary by facility and configuration, so the broad message pivots may require tuning. The MikroTik “Flagged” mechanism only becomes available after upgrading to a fixed release and should not be treated as a substitute for reviewing suspicious configuration changes.
Killian Sherer 