Threat actors are actively exploiting vulnerabilities in MikroTik RouterOS to gain full administrative control of routers with SSH services exposed to the internet, CERT-Polska warned.
The attacks have been ongoing since at least September 2. CERT-Polska said the exploitation chain combines multiple vulnerabilities. The most important flaws, according to the agency, include CVE-2026-67276 (an SSH authentication bypass), CVE-2026-86060, which allows privilege manipulation through a specially crafted username and CVE-2026-67277, which can cause memory disclosure and crashes through the bandwidth-test service.
Other two patched flaws include CVE-2026-67279, which allows to modify files in the RouterOS managed file namespace, and CVE-2026-67281, an access of uninitialized pointer issue that allows a remote attacker to disclose root-owned files.
MikroTik has released fixes in RouterOS 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. Users are recommended to update to the patched versions as soon as possible.
After updating, administrators should check for signs of compromise, including unknown users, scripts, scheduler tasks, proxy settings and tunnels. In particular, admins should be on the lookout for a highly privileged account named “ops.” CERT Polska said attacks that created this account were traced to the IP address 82.192.72.4, while 103.102.31.18 was used in exploitation attempts.
Newer RouterOS releases include a “Flagged” mechanism that checks the configuration at startup for certain known signs of compromise and disables suspicious entries. However, the absence of the flag does not prove that a device is clean.
“We cannot rule out the existence of vulnerabilities unknown to us that the vendor did not describe in the changelog. The "Flagged" marker for compromised devices should therefore be treated as an indication of a possible earlier compromise, not as proof that one of the vulnerabilities reported by CERT Polska was exploited,” the agency explained.
If an update can’t be installed right away, administrators should disable exposed services or restrict them to trusted networks, especially SSH, WWW/WWW-SSL and the bandwidth-test server. Users should also avoid initiating TLS connections or using RouterOS's built-in SSH clients from an unpatched device across untrusted networks.