# MikroTik SSH Auth Bypass Under Active Exploit

Published: 2026-09-06 · Severity: high · Sectors: infrastructure, telecommunications
Canonical: https://vorant.io/reports/1e375d85-82a5-58b3-8a2d-747efc7ba932/mikrotik-ssh-auth-bypass-under-active-exploit

> MikroTik has patched an already-exploited SSH authentication bypass; admins should assume compromise and check for attacker-added accounts.

SANS ISC reports that MikroTik released an emergency patch for a critical SSH authentication bypass vulnerability that is already being actively exploited in the wild. Attackers exploiting the flaw have been observed adding new administrative accounts to compromised RouterOS devices, a persistence technique intended to maintain access even after the device is patched. Because the vulnerability allows bypassing SSH authentication entirely, any exposed and unpatched MikroTik device should be treated as potentially compromised rather than merely vulnerable.

MikroTik's patch includes a detection mechanism that will mark affected devices with a 'Flagged' status if signs of prior compromise are found, giving defenders a built-in indicator to check post-patch. Given the scale of MikroTik device deployment (particularly RouterOS-based routers commonly used by ISPs, small businesses, and home users), and the fact that exploitation is already underway, this represents an urgent, actively exploited threat to internet-facing network infrastructure.

Defenders running MikroTik RouterOS devices should apply the vendor patch immediately, review the device's user account list for any unauthorized or unrecognized accounts added by attackers, check for the 'Flagged' compromise status after patching, and restrict SSH access to trusted management networks where possible. Full technical details are available in MikroTik's security advisory.

## Detection guidance (public sample)

### MikroTik RouterOS SSH Authentication Bypass Exploitation Attempts

ATT&CK: T1190

Detects SSH authentication bypass attempts against MikroTik RouterOS devices, characterized by malformed or oversized SSH packets and authentication failures followed by successful command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MikroTik RouterOS SSH Authentication Bypass Exploitation Attempts
description: Detects exploitation attempts against MikroTik RouterOS SSH authentication
  bypass vulnerability. The exploit sends malformed SSH protocol packets to bypass
  authentication checks. Rule identifies failed SSH authentication events rapidly
  followed by successful command execution or account creation from the same source,
  indicating auth bypass.
tags:
- attack.t1190
- attack.t1078
logsource:
  product: mikrotik
  service: routeros
  category: process_creation
detection:
  selection_ssh_auth_failure:
    EventType|contains:
    - ssh_auth_failure
    - ssh_invalid_user
    Source: external
  selection_ssh_command_exec:
    CommandLine|contains:
    - /user
    - /ip
    - /system
    EventType: ssh_command_executed
  filter_bruteforce:
    EventType: ssh_auth_failure
    Frequency|gt: 10
  condition: selection_ssh_auth_failure and selection_ssh_command_exec and not filter_bruteforce
falsepositives:
- Legitimate administrators with forgotten credentials retrying login
- Configuration management tools with stale credentials
level: critical
id: 60cc4910-f976-57cb-8990-31028e69da0e
status: experimental
author: Vorant
```

### MikroTik RouterOS Post-Patch Compromise Indicator Detection

ATT&CK: T1078

Detects MikroTik RouterOS devices flagged with compromise status after applying emergency security patch, indicating prior exploitation of authentication bypass vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MikroTik RouterOS Post-Patch Compromise Indicator Detection
description: Detects MikroTik RouterOS devices with 'Flagged' compromise status set
  by the vendor's emergency patch. When MikroTik's patched RouterOS version runs,
  it checks for signs of prior exploitation (unauthorized accounts, suspicious command
  history, modified system files) and marks affected devices with a Flagged status
  indicator. This rule alerts on the presence or activation of this compromise flag.
tags:
- attack.discovery
- attack.t1078
logsource:
  product: mikrotik
  service: routeros
  category: process_creation
detection:
  selection:
    EventType: system_flag_set
    FlagName: Flagged
    FlagReason|contains:
    - compromise
    - unauthorized_access
    - ssh_bypass
  condition: selection
falsepositives:
- Test environments or honeypots intentionally running vulnerable versions
- Devices flagged due to legitimate configuration changes misinterpreted by detection
  logic
level: high
id: b184c949-8e2c-5c52-a25f-6af19e3ef4ff
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33314

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1e375d85-82a5-58b3-8a2d-747efc7ba932/mikrotik-ssh-auth-bypass-under-active-exploit.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup