# MikroTik RouterOS flaws let attackers hijack admins

Published: 2026-09-14 · Severity: severe · Sectors: infrastructure, telecommunications, government-national
Canonical: https://vorant.io/reports/13850cd0-52a1-524b-ae2f-55a212848f58/mikrotik-routeros-flaws-let-attackers-hijack-admins

> Exploited-in-the-wild RouterOS bugs let attackers bypass SSH auth or escalate to full admin control without credentials.

MS-ISAC has issued an advisory covering multiple vulnerabilities in MikroTik RouterOS that could allow unauthenticated attackers to hijack admin access. The most severe issue, CVE-2026-67276, is an SSH authentication bypass where RouterOS only compares the public modulus of a user's RSA key rather than the full key, allowing an attacker who knows a username and its modulus to craft a different key and log in with that account's privileges without possessing the private key. CVE-2026-86060 is a privilege escalation flaw triggered by SSH usernames beginning with a disallowed character, which can return a session with full administrative privileges. CVE-2026-67277 involves the bandwidth-test service allowing unauthenticated connections to reach an authenticated-only state, combined with uninitialized packet-buffer leakage and an integer underflow in size validation, potentially exposing kernel memory or crashing the device.

MS-ISAC states there are reports of these vulnerabilities being exploited in the wild, making this an active threat rather than a theoretical one. Affected systems are RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, spanning both stable and long-term branches, which affects a broad population of home, business, and ISP routers. Successful exploitation of the most severe flaw could grant an attacker full unauthenticated control of the device.

Defenders should prioritize applying MikroTik's stable channel update to all affected RouterOS devices after testing, and treat externally-exposed RouterOS instances with SSH or bandwidth-test services enabled as high priority for patching and scanning. Given active exploitation and the low complexity of gaining full device control, organizations running MikroTik infrastructure should also review SSH access logs and audit device management interfaces for unauthorized access or unexpected admin accounts.

## Mentioned in this report

- Vulnerabilities: CVE-2026-67276, CVE-2026-67277 (KEV), CVE-2026-86060 (KEV)

## Detection guidance (public sample)

### MikroTik RouterOS SSH Authentication Bypass - RSA Modulus Mismatch

ATT&CK: T1548.002

Detects SSH authentication attempts to MikroTik RouterOS where the RSA public key modulus does not match the stored key for the authenticated user, indicative of CVE-2026-67276 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MikroTik RouterOS SSH Authentication Bypass - RSA Modulus Mismatch
description: Detects SSH authentication attempts where the RSA key presented does
  not match the stored key for a given user account on MikroTik RouterOS, exploiting
  CVE-2026-67276 where the device only validates the public modulus rather than the
  full key. This allows attackers to craft alternate RSA keys for hijacked admin accounts.
tags:
- attack.defense-evasion
- attack.t1548.002
logsource:
  category: authentication
  product: mikrotik_routeros
detection:
  selection:
    EventType: ssh_key_mismatch
    AuthenticationMethod: publickey
    Result: success
    AccountName|endswith:
    - admin
    - administrator
  condition: selection
falsepositives:
- Legitimate key rotation where a user regenerates their RSA keypair and logs in before
  updating stored keys
- Automated backup or monitoring tools cycling keys during credential rollover
level: critical
id: 9dbd6d72-b53c-53c7-a6cd-3338b859a4ed
status: experimental
author: Vorant
```

### MikroTik RouterOS Privilege Escalation via Invalid SSH Username Character

ATT&CK: T1068

Detects SSH login attempts using usernames beginning with disallowed characters on MikroTik RouterOS, which can escalate to full administrative privileges via CVE-2026-86060. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MikroTik RouterOS Privilege Escalation via Invalid SSH Username Character
description: Detects SSH authentication attempts to MikroTik RouterOS using usernames
  that begin with disallowed/invalid characters, exploiting CVE-2026-86060 where such
  malformed usernames trigger elevation to full administrative session context despite
  unprivileged account status.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: authentication
  product: mikrotik_routeros
detection:
  selection:
    EventType: ssh_login
    AuthenticationMethod: password
    AccountName|re: ^[^a-zA-Z0-9_-].*
  filter_legitimate:
    AccountName|startswith:
    - root
    - sync
  condition: selection and not filter_legitimate
falsepositives:
- Custom user accounts created with non-standard naming conventions in specialized
  deployments
- Directory service integration with non-ASCII user identifiers
level: high
id: 1fa05da9-589b-5a56-8bb6-b5afad63214f
status: experimental
author: Vorant
```

### MikroTik RouterOS Bandwidth-Test Service Unauthenticated Access

ATT&CK: T1068

Detects unauthenticated connections to MikroTik RouterOS bandwidth-test service (UDP port 2048) that transition to authenticated state, exploiting CVE-2026-67277 to access restricted functionality without credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MikroTik RouterOS Bandwidth-Test Service Unauthenticated Access
description: Detects unauthenticated network connections to MikroTik RouterOS bandwidth-test
  service that achieve authenticated-only functionality, exploiting CVE-2026-67277
  where the service allows unauthenticated clients to reach authenticated protocol
  states, combined with buffer leakage and integer underflow vulnerabilities.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: network_connection
  product: mikrotik_routeros
detection:
  selection:
    DestinationPort: 2048
    Protocol: udp
    AuthenticationStatus: unauthenticated
    ConnectionState|contains:
    - authenticated_protocol_reached
    - buffer_access_granted
  condition: selection
falsepositives:
- Legitimate bandwidth testing tools connecting to authorized bandwidth-test service
  endpoints
- Internal network diagnostics performed by authorized administrators
level: high
id: e4802458-d5c9-564e-bf9c-d400d85ecd05
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mikrotik-routers-could-allow-for-admin-hijacking_2026-095

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/13850cd0-52a1-524b-ae2f-55a212848f58/mikrotik-routeros-flaws-let-attackers-hijack-admins.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup