[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffGKTSIydO4JPNtk_d0KKFHD9vZy3WDbWWwREWs9KYzk":3},{"article":4,"iocs":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":27,"category":28,"article_tags":32},"8fd68da0-5ab2-48ec-9f14-63470da23fb2","Hackers exploit new MikroTik RouterOS flaws to hijack routers","hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers-23a72d","Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet. [...]","Hackers are actively exploiting a chain of two critical vulnerabilities in MikroTik RouterOS (CVE-2026-67276 and CVE-2026-86060) to gain full administrative control of exposed routers. A third flaw (CVE-2026-67277) affecting the bandwidth-test service can also lead to memory leaks or router restarts. MikroTik has released patches, but users are advised to restrict SSH access if immediate updates are not possible.","Hackers exploit two new MikroTik RouterOS flaws to hijack routers via SSH.","Hackers exploit new MikroTik RouterOS flaws to hijack routers By Bill Toulas September 7, 2026 06:32 AM 0 Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet. One of the security issues, tracked as CVE-2026-67276, is an SSH authentication bypass flaw in MikroTik RouterOS caused by incomplete validation of RSA public keys. An attacker who knows a username and the public modulus of that user’s key can exploit it by crafting a different key and logging in without the legitimate private key. The second security issue is identified as CVE-2026-86060. It is an SSH privilege escalation flaw in MikroTik RouterOS due to improper handling of specially crafted usernames. Hackers can leverage it using a specially crafted username to manipulate the SSH session so that the attacker obtains full administrative privileges. Both vulnerabilities were discovered by Poland's CERT agency with the help of GPT-5.5-cyber and GPT-5.6-sol and received a critical severity rating. The Polish agency dubbed the exploit chain “MikroTrick,” and warned that it is now actively exploited in the wild. “In recent days we have been observing attacks against RouterOS devices accessible from the internet,” Poland's CERT warns. “We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks.” The Polish CERT also highlighted a third flaw, CVE-2026-67277, which affects the RouterOS bandwidth-test service and allows unauthenticated attackers to leak kernel memory or to remotely crash\u002Frestart the router. MikroTik fixed the vulnerabilities in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, released on September 3, and Poland's CERT validated the fixes. In its advisory, the vendor notes that not all configurations are affected, but did not disclose any details to give users time to apply the security updates. The updates add a compromise-detection mechanism to the routers that looks for known signs of unauthorized configuration changes at startup, disables malicious entries, and logs a critical warning. However, the CERT notes that the absence of a marker indicating compromise should not be taken as a guarantee that a router has not been compromised. The CERT shared the following indicators of compromise (IoCs): Log entries: ‘login failure for user -2 from \u003Cip> via ssh’ and ‘user \u003Cname> added by ssh:-2@\u003Cip>’ Presence of a highly privileged ops account 82.192.72.4 — linked to confirmed successful attacks 103.102.31.18 — observed attempting to exploit MikroTrick If compromise is suspected, the Polish agency recommends isolating the router, preserving logs and configuration, then factory-resetting the device and rebuilding it from a trusted configuration while rotating passwords, keys, and other secrets. For those unable to apply the updates immediately, one recommendation is to restrict or disable externally accessible SSH, WWW\u002FWWW-SSL, and bandwidth-test services, and avoid the built-in SSH clients and outbound TLS connections over untrusted networks. As of September 5, there were 122,500 MikroTik devices with an exposed SSH interface, according to data provided by The ShadowServer Foundation. The exact number of devices vulnerable the MikroTik exploit was not determined, though. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Unpatched Calix flaw lets hackers bypass NAT to expose internal devicesGoogle warns of new Chrome zero-day flaw exploited in attacksCritical Elementor Pro flaw exploited to take over WordPress sitesHackers exploit Sangoma Switchvox flaw to deploy reverse shellsHackers exploit critical JFrog Artifactory flaw to forge admin tokens","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F07\u002Fmikrotik.jpg","2026-09-07T10:32:40+00:00","2026-09-07T12:00:06.489897+00:00",9,[18,21,24],{"name":19,"type":20},"RouterOS","product",{"name":22,"type":23},"MikroTik","vendor",{"name":25,"type":26},"MikroTrick","campaign","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,35,40,45],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,58,61,65],{"type":52,"value":53,"context":54},"cve","CVE-2026-67276","SSH authentication bypass flaw in MikroTik RouterOS",{"type":52,"value":56,"context":57},"CVE-2026-86060","SSH privilege escalation flaw in MikroTik RouterOS",{"type":52,"value":59,"context":60},"CVE-2026-67277","Bandwidth-test service flaw allowing memory leak or router restart",{"type":62,"value":63,"context":64},"ip","82.192.72.4","IP linked to confirmed successful attacks",{"type":62,"value":66,"context":67},"103.102.31.18","IP observed attempting to exploit MikroTrick"]