If you administer a MikroTik router, install the appropriate fixed RouterOS release and restrict SSH and other management services to trusted networks. CERT Polska confirmed that the MikroTrick takeover chain targeted devices with SSH reachable from public networks. That is a specific exposure condition—not evidence that every MikroTik router or every public management interface was vulnerable to the observed chain. After patching, check logs and configuration for signs of unauthorized changes; a clean-looking check does not prove the router was never compromised.
What the MikroTrick campaign establishes about exposure
The operational question is whether a router’s relevant service was reachable under the conditions used in the attack and whether RouterOS has been updated to a fixed build. CERT Polska named the campaign MikroTrick and confirmed active attacks against devices whose SSH service was accessible from public networks. MikroTik says its default configuration blocks SSH from the internet, but administrators can change that configuration. Check the router’s actual service and firewall settings and any upstream network rules; do not assume that the default still applies.
As an Amazon Associate I earn from qualifying purchases.
The cited advisories do not establish a representative count of globally exposed, vulnerable, or compromised MikroTik routers. DIVD began scanning for vulnerable appliances on September 17, 2026, and notifying potential affected parties on September 21, 2026; those dates describe response activity, not the size of the affected population.
Free tools Windows power users keep installed
One-click scans. No signup required.
Which vulnerabilities make up the reported chain?
CERT Polska identified six vulnerabilities overall, affecting the SSH server and client, bandwidth-test service, X.509 certificate handling, and WebFig. Its campaign notice highlights three; the two SSH flaws form the reported full-control chain. The bandwidth-test issue is a separate vulnerability, not another step in that SSH chain.
#1 Best Overall
- hEX also known as RB750Gr3 is a five port Gigabit Ethernet router for locations where wireless connectivity is not required
- The device has a full size USB port. This new updated revision of the hEX brings several improvements in performance
- It is affordable, small and easy to use, but at the same time comes with a very powerful dual core 880MHz CPU and 256MB RAM
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude
- Dimensions: 113x89x28mm; Storage size: 16 MB; Passive PoE (PoE in); PCB temperature monitor, Voltage monitor and Mode button
| Issue | What the advisories say | Reported severity |
|---|---|---|
| CVE-2026-67276 | CERT Polska says incomplete verification of an RSA public key during SSH authentication could let an attacker who knew the username and public modulus craft another key and log in without the corresponding private key, with the targeted account’s privileges. | CVSS v4 9.2, as reported by DIVD CSIRT in 2026. |
| CVE-2026-86060 | DIVD describes an SSH privilege-escalation issue involving handling of prohibited characters in SSH usernames. Combined with the authentication bypass, it was part of the reported takeover chain. | CVSS v4 9.2, as reported by DIVD CSIRT in 2026. |
| CVE-2026-67277 | A separate issue in the bandwidth-test service. DIVD describes possible router restart or kernel-memory disclosure impact. | CVSS v4 8.8, as reported by DIVD CSIRT in 2026. |
These scores describe vulnerability severity, not campaign prevalence or the number of affected devices. DIVD cautions that MikroTik’s advisory does not publish a complete affected-version matrix, so the advisories do not support a precise vulnerable-version range.
Which RouterOS releases contain the listed fixes?
MikroTik lists the following fixed builds. Choose the appropriate maintained RouterOS channel for the device, install its applicable update, and verify the installed version afterward. These are the fix thresholds named in the advisories; they should not be read as a complete list of every affected version.
Rank #2
- Wired Gigabit Router – 5x Gigabit Ethernet ports, 2.5G SFP, PoE-Out, USB, powered by RouterOS
| RouterOS release line | Fixed build listed by MikroTik |
|---|---|
| 7.25 beta | 7.25 beta 3 |
| 7.24 | 7.24.2 |
| 7.23 | 7.23.4 |
| 6.49 | 6.49.21 |
CERT Polska recommends applying the update immediately. Updating is the priority even if SSH is currently restricted: access controls reduce exposure, but they do not install the fixes.
How to reduce management-plane exposure
MikroTik’s September 2026 security advisory says: “Make sure SSH is not open to any untrusted networks.” It recommends limiting manually opened SSH to trusted IP addresses and using a strong VPN such as WireGuard for remote administration rather than exposing management ports broadly.
- Review which RouterOS management and diagnostic services are enabled and which source networks can reach them, including through upstream firewalls or port forwarding.
- Allow management access only from trusted networks or through a VPN. Do not leave SSH, WebFig, or other management services open to untrusted networks merely for convenience.
- If you cannot update immediately, CERT Polska advises disabling exposed services or restricting them to trusted management networks, particularly SSH, WWW/WWW-SSL, and the bandwidth-test server.
- Until the device is patched, CERT Polska also advises not initiating TLS connections from it or using its built-in SSH clients through untrusted networks.
These interim restrictions reduce reachable attack surface; they are not a substitute for installing a fixed release.
How to check for signs of compromise after updating
CERT Polska says the fixed releases scan for selected known signs of unauthorized changes. When a recognized suspicious entry is found, the release disables it, writes a critical message to the RouterOS log, and sets the device-mode Flagged status. Treat either the log message or Flagged status as a reason to investigate. The checks cover selected traces only: no Flagged marker is not proof that the router was never compromised.
Rank #4
- MikroTik RouterBOARD C52iG-5HaxD2HaxD-TC-US (US Version) hAP ax (WiFi6) Quad-Core IPQ-6010 864 MHz, RAM 1GB, RouterOS, License level 4 It's time to supercharge your home network with the Generation
- hAP ax has everything you might need in a primary home access point - and more
- Forget endless reviews and comparisons - this is the perfect device for 99% of homes
- Wireless signal is now stronger than ever
- Here are the two main ingredients of hAP ax's success: a state-of-the-art dual-band, dual-chain 4-4
Review the configuration as well as the log. Look for entries you cannot account for, including:
Recommended Free Tools
- Unknown user accounts, especially a highly privileged account named
ops. - Unexpected scripts or scheduler tasks.
- Unrecognized proxy servers, tunnels, or other configuration changes.
- Log patterns CERT Polska reports, including a failed SSH login for user
-2or an account added via SSH as-2.
These are investigation leads, not a complete signature set. A matching name or log entry warrants review in context; absence of these indicators does not certify the device as clean. CERT Polska also publishes time-sensitive IP indicators for a successful attack and a separate attempt. Check its current advisory before using those addresses for blocking or incident decisions rather than treating a copied indicator as permanently current.
Best Value
- W128339515
What to do if you suspect the router was compromised
- Isolate the router from untrusted networks and follow your organization’s incident-response procedures.
- Preserve evidence before resetting. Save available logs and configuration, and do not clear the Flagged marker before evidence is secured.
- Restore and rebuild from a trusted basis. After evidence is secured, CERT Polska advises factory restoration and reconfiguration from a trusted, verified configuration. Do not blindly restore a full backup from a router that may have been compromised.
- Rotate secrets. Change passwords, keys, and other credentials that the router or its management environment could have exposed.
For organizations managing fleets or investigating a suspected intrusion, professional network-security or incident-response support may be appropriate. The immediate technical priorities remain restricting access, patching, preserving evidence, and rebuilding from a trusted configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
