Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutePre-authentication means a vulnerable operation can be reached before a service has verified who the client is. In the MikroTrick attack chain, CERT Polska confirmed that attackers combined two RouterOS vulnerabilities to gain full administrative privileges without logging in on devices whose SSH service was reachable from public networks. The finding does not mean every RouterOS vulnerability works this way—or that every router is exposed.
How the MikroTrick attack chain worked
CERT Polska’s September 5, 2026 incident report described active exploitation of a two-vulnerability chain it named MikroTrick. The first flaw, CVE-2026-67279, let an unauthenticated SSH connection reach session-channel handling rather than requiring the normal authentication step first. Attackers then used CVE-2026-86060, which affects argument handling in the login path, to obtain a session with full administrative privileges.
As an Amazon Associate I earn from qualifying purchases.
In plain terms, the attacker did not first guess or steal a password. The chain reached vulnerable SSH processing before identity verification had succeeded, then abused the login path to elevate access. CERT Polska reported successful exploitation against devices with SSH publicly reachable; a flaw being unauthenticated does not, by itself, make a router reachable from every network.
Which RouterOS vulnerabilities were involved?
The September 2026 disclosures covered six issues with different access requirements, affected services and impacts. The MikroTrick chain is specifically CVE-2026-67279 plus CVE-2026-86060. CVE-2026-67276 is another SSH-related vulnerability, but it is a separate issue, not a link in that chain.
#1 Best Overall
- hEX also known as RB750Gr3 is a five port Gigabit Ethernet router for locations where wireless connectivity is not required
- The device has a full size USB port. This new updated revision of the hEX brings several improvements in performance
- It is affordable, small and easy to use, but at the same time comes with a very powerful dual core 880MHz CPU and 256MB RAM
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude
- Dimensions: 113x89x28mm; Storage size: 16 MB; Passive PoE (PoE in); PCB temperature monitor, Voltage monitor and Mode button
| CVE | Service or path | Authentication and reported impact | Reported active exploitation |
|---|---|---|---|
| CVE-2026-67279 | SSH session-channel handling | An unauthenticated connection could reach channel handling; vulnerability records also describe file operations through SSH after a rekey. Used as the first stage of MikroTrick. | Yes, as part of the chain CERT Polska reported. |
| CVE-2026-86060 | SSH login path | Argument-handling flaw used after CVE-2026-67279 to obtain full administrative privileges. | Yes, as part of the chain CERT Polska reported. |
| CVE-2026-67276 | SSH public-key authentication | Failure to compare the full RSA public key could allow an attacker who knows an authorized user’s name and RSA modulus to forge a valid signature using an exponent-one key, without that user’s private key. CERT Polska assigned CVSS 9.2. | Not identified as part of the MikroTrick chain. |
| CVE-2026-67277 | Bandwidth-test service | An unauthenticated issue that could disclose uninitialized kernel memory or cause a restart. CERT Polska assigned CVSS 8.8. | Not stated in CERT Polska’s incident report. |
| CVE-2026-67278 | Certificate handling | Malformed RSA signatures could be accepted. The initial fix was incomplete; later branch-specific fixes are described below. | Not stated in CERT Polska’s incident report. |
| CVE-2026-67281 | WebFig | An unauthenticated file-read issue. | Not stated in CERT Polska’s incident report. |
“Not stated” means CERT Polska’s incident report did not establish active exploitation for that issue; it is not a claim that exploitation is impossible. The CVSS figures are severity scores, not estimates of the likelihood that a particular router is exposed or compromised.
What “pre-authentication” does—and does not—tell you
Authentication is the process by which a service checks a client’s identity, for example by accepting a password or cryptographic key. A pre-authentication vulnerability allows an attacker to reach a vulnerable operation before that check succeeds. It describes the attack’s position in the access sequence, not the network conditions needed to reach the service or the eventual impact.
Rank #2
- Wired Gigabit Router – 5x Gigabit Ethernet ports, 2.5G SFP, PoE-Out, USB, powered by RouterOS
Those details vary by vulnerability. For example, MikroTik’s historical CVE-2018-115X advisory described web-server issues that required a known username and password and allowed an authenticated user to crash the www service. That is different from an unauthenticated route to SSH channel handling or a WebFig file-read flaw. For each issue, check the required access, exposed service and resulting impact rather than treating “RouterOS vulnerability” as one uniform attack path.
Recommended Free Tools
Which RouterOS versions were listed as fixed?
MikroTik’s September 3, 2026 security advisory listed fixes in RouterOS 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21, and recommended upgrading. CERT Polska’s September 5 vulnerability records also list 7.24.2, 7.23.4 and 6.49.21 for applicable issues. These are branch-specific releases, not a universal version number that applies to every installation.
There is a specific exception for CVE-2026-67278: CERT Polska says the earlier fixes were incomplete, and lists 7.23.6 long-term and 7.24.3 stable as later fixes. Administrators should identify the CVE and RouterOS branch relevant to their device and check MikroTik’s current release guidance before deciding that an installation is patched.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What administrators should do
- Restrict remote management. MikroTik advises against exposing SSH to untrusted networks. If remote management is necessary, restrict access to trusted IP addresses or use a strong VPN such as WireGuard; do not open management ports to the internet.
- Upgrade RouterOS. Apply a fixed release appropriate to the device’s branch, checking current vendor guidance and the CVE-2026-67278 exception rather than relying on the initial patch list alone.
- Review the configuration after upgrading. MikroTik advises checking for unknown scripts, users or other changes. CERT Polska specifically calls out unexpected users, scripts, scheduler tasks, proxy servers and tunnels as items to investigate.
- Take a Flagged result seriously, but do not treat its absence as clearance. CERT Polska says the Flagged mechanism detects selected signs of unauthorized changes. If the device is marked, treat it as potentially compromised and follow incident-response guidance; an unmarked device is not thereby proven clean.
CERT Polska did not provide a defensible population-wide count or percentage of affected RouterOS devices. Exposure and compromise therefore cannot be inferred from a global prevalence figure in the available incident reporting.
Quick Recap
Best Value
- W128339515
Rank #4
- MikroTik RouterBOARD C52iG-5HaxD2HaxD-TC-US (US Version) hAP ax (WiFi6) Quad-Core IPQ-6010 864 MHz, RAM 1GB, RouterOS, License level 4 It's time to supercharge your home network with the Generation
- hAP ax has everything you might need in a primary home access point - and more
- Forget endless reviews and comparisons - this is the perfect device for 99% of homes
- Wireless signal is now stronger than ever
- Here are the two main ingredients of hAP ax's success: a state-of-the-art dual-band, dual-chain 4-4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
