MikroTik RouterOS Zero-Days Exploited Since September 2 as “MikroTrick” Chain Gives Attackers Full Admin Control
CERT Polska has confirmed that attackers are exploiting a two-vulnerability MikroTik RouterOS chain dubbed MikroTrick to take full control of internet-exposed routers. MikroTik has shipped fixes and added a mechanism that flags selected signs of compromise.
Why it matters: This is an actively exploited network-edge compromise affecting RouterOS installations with exposed SSH, with a chain capable of yielding full administrative control.
MikroTik administrators are being urged to update RouterOS immediately after CERT Polska confirmed active exploitation of a two-vulnerability chain capable of taking full administrative control of devices whose SSH service is exposed to the internet. Researchers named the chain MikroTrick.
The chain combines CVE-2026-67276, an SSH authentication weakness, with CVE-2026-86060, a privilege-manipulation flaw in the RouterOS SSH login process. CERT Polska says successful attacks have been observed since at least September 2.
MikroTik has released fixes in RouterOS 7.24.2, 7.23.4 and 6.49.21. Administrators should also review internet-facing management exposure and inspect devices for unauthorized users, scripts, scheduled jobs, tunnels and other persistence.
The incident highlights why routers and remote-management appliances remain high-value targets: compromising the network edge can provide persistence and visibility without first defeating endpoint controls.