# MikroTik RouterOS SSH Flaws Exploited in Wild

Published: 2026-09-05 · Severity: severe · Sectors: infrastructure
Canonical: https://vorant.io/reports/5c002b52-eef3-5418-8cf3-c4519ed84503/mikrotik-routeros-ssh-flaws-exploited-in-wild

> CERT Polska confirms attackers are chaining two RouterOS SSH vulnerabilities (dubbed MikroTrick) to gain full unauthenticated control of internet-exposed MikroTik routers.

CERT Polska disclosed six vulnerabilities in MikroTik RouterOS affecting the SSH server/client, the bandwidth-test service, X.509 certificate handling, and the WebFig interface. Two of these — an SSH public-key authentication bypass (CVE-2026-67276) and a crafted-username privilege manipulation flaw (CVE-2026-86060) — can be chained to give an unauthenticated attacker full administrative control of any RouterOS device that exposes SSH to the internet. CERT Polska has named this chain "MikroTrick" and confirmed it is being actively exploited against internet-facing devices; MikroTik's patches (7.25beta3, 7.24.2, 7.23.4, 6.49.21) have been verified to stop the observed attacks. A third notable flaw, an unauthenticated memory-disclosure/DoS bug in the bandwidth-test service (CVE-2026-67277), can leak kernel memory or crash the device.

Post-patch, RouterOS includes a new "Flagged" mechanism that scans configuration at startup for known signs of compromise and logs a warning marker, but CERT Polska stresses this only detects specific known artifacts and its absence does not prove a device is clean. Observed compromise indicators include SSH log entries showing "login failure for user -2" followed by a user added via "ssh:-2@<ip>", and the presence of an unexpected highly-privileged account named "ops". Notably, the vulnerabilities were discovered using an LLM-assisted (GPT-5.5/5.6) automated research pipeline under OpenAI's GTAC program, combined with human-verified lab testing.

Defenders running MikroTik RouterOS, particularly with SSH, WebFig, or bandwidth-test exposed to the internet, should patch immediately, audit for unknown users/scripts/scheduler tasks/proxies/tunnels, check the Flagged marker and logs for the indicators described, and if compromise is suspected, isolate the device, preserve logs/config, and rebuild from a trusted configuration rather than restoring a backup from a potentially compromised device.

## Mentioned in this report

- Vulnerabilities: CVE-2026-67276, CVE-2026-67277 (KEV), CVE-2026-86060 (KEV)
- Campaigns: MikroTrick

## Detection guidance (public sample)

### MikroTik RouterOS Unauthorized Admin Account Creation

ATT&CK: T1136

Detection of unexpected high-privilege user accounts created on MikroTik RouterOS devices, particularly 'ops' or accounts matching the SSH auth-bypass compromise pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MikroTik RouterOS Unauthorized Admin Account Creation
description: Detects creation of unexpected administrative accounts on MikroTik RouterOS,
  a sign of post-exploitation persistence. Looks for account names commonly observed
  in MikroTrick chain attacks (e.g., 'ops') or pattern-based matches in logs.
tags:
- attack.persistence
- attack.t1136
logsource:
  category: process_creation
  product: mikrotik
detection:
  selection_ops_account:
    CommandLine|contains:
    - add name=ops
    - /user add name=ops
    Image|endswith:
    - /user
    - user.rsc
  selection_ssh_compromise_pattern:
    CommandLine|contains: ssh:-2
    Image|endswith:
    - /user
    - user.rsc
  filter_backup_restore:
    CommandLine|contains:
    - import
    - backup
  condition: (selection_ops_account or selection_ssh_compromise_pattern) and not filter_backup_restore
falsepositives:
- Legitimate administrator account creation during initial device setup
- Restoration from a known-clean backup containing these accounts
level: high
id: 60b30848-145c-5865-bf47-1f59aa5b6d53
status: experimental
author: Vorant
```

### MikroTik RouterOS SSH Authentication Bypass Exploitation Attempt

ATT&CK: T1190

Detection of SSH login failures followed by account creation with '-2' username, indicative of CVE-2026-67276 and CVE-2026-86060 exploitation chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MikroTik RouterOS SSH Authentication Bypass Exploitation Attempt
description: Detects the MikroTrick exploitation pattern - SSH login failure for user
  '-2' followed by account provisioning with ssh:-2 prefix. This is a reliable indicator
  of active exploitation of CVE-2026-67276 and CVE-2026-86060.
tags:
- attack.t1190
logsource:
  category: process_creation
  product: mikrotik
detection:
  selection_ssh_failure:
    Image|endswith: sshd
    CommandLine|contains: user -2
  selection_account_add:
    Image|endswith:
    - /user
    - user.rsc
    CommandLine|contains: ssh:-2@
  condition: selection_ssh_failure and selection_account_add
falsepositives:
- Legitimate SSH troubleshooting or failed login attempts from authorized personnel
level: critical
id: 5100494f-e1e3-5d4e-8d21-c742600c59a8
status: experimental
author: Vorant
```

### MikroTik RouterOS Privilege Escalation via Crafted Username

ATT&CK: T1548

Detection of account creation or modification using crafted usernames (e.g., '-2' or special prefixes) that bypass privilege validation on MikroTik RouterOS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MikroTik RouterOS Privilege Escalation via Crafted Username
description: 'Detects exploitation of CVE-2026-86060 - creation of accounts with special/crafted
  usernames (particularly ''-2'' prefix or ssh: prefixes) that bypass privilege checks
  and grant admin access. Monitors user management operations for this pattern.'
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
  category: process_creation
  product: mikrotik
detection:
  selection_crafted_usernames:
    Image|endswith:
    - /user
    - user.rsc
    CommandLine|contains:
    - add name=-
    - 'add name=ssh:'
    - '@'
  selection_admin_grant:
    CommandLine|contains:
    - group=admin
    - permissions=full
  filter_legitimate_user:
    CommandLine|contains: name=admin
  condition: (selection_crafted_usernames and selection_admin_grant) and not filter_legitimate_user
falsepositives:
- Automated provisioning scripts using unconventional naming schemes (rare)
level: high
id: 20027a57-06ea-5da5-ac87-1a331536be2e
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5c002b52-eef3-5418-8cf3-c4519ed84503/mikrotik-routeros-ssh-flaws-exploited-in-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup