Free tools Windows power users keep installed
One-click scans. No signup required.
If a MikroTik router answers SSH from the internet and runs a RouterOS release older than the September 2026 fixes, treat it as a priority incident. CERT Polska, which calls the pair of flaws MikroTrick, says CVE-2026-67279 and CVE-2026-86060 can be chained to gain full administrative access without a password, key or completed login. It also says it confirmed attacks using that chain against devices whose SSH service was reachable from public networks (CERT Polska exploitation notice).
The fix is a RouterOS upgrade to the right release for your branch. Closing public SSH shrinks your exposure but does not replace patching. It also does not tell you whether a device was already compromised. This article covers how the chain works, which versions are affected, and the order in which to respond.
As an Amazon Associate I earn from qualifying purchases.
What each flaw does, and why the pair matters
Neither flaw is a complete takeover on its own. The danger comes from combining them, and that is the scope of the confirmed exploitation report.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →CVE-2026-67279: SSH proceeds without finishing authentication
During a client-initiated SSH rekey before user authentication had completed, affected RouterOS builds wrongly moved into connection and channel handling instead of resuming authentication. An unauthenticated client could then open a session channel and send requests such as exec. CERT Polska stresses that this flaw does not create an authenticated identity or grant privileges by itself. It is the prerequisite that lets an attacker reach the second flaw (CERT Polska technical analysis; CERT Polska vulnerability record).
#1 Best Overall
- hEX also known as RB750Gr3 is a five port Gigabit Ethernet router for locations where wireless connectivity is not required
- The device has a full size USB port. This new updated revision of the hEX brings several improvements in performance
- It is affordable, small and easy to use, but at the same time comes with a very powerful dual core 880MHz CPU and 256MB RAM
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude
- Dimensions: 113x89x28mm; Storage size: 16 MB; Passive PoE (PoE in); PCB temperature monitor, Voltage monitor and Mode button
CVE-2026-86060: a crafted username alters the policy mask
A username beginning with a prohibited character could change how RouterOS’s SSH login helper interpreted its arguments. That in turn altered the trusted RouterOS policy mask and escalated privileges. In the fixed builds, the vendor validates the username before passing it to the login application (CERT Polska vulnerability record; CERT Polska technical analysis). CERT Polska’s exploitation notice lists a CVSS score of 9.2 for this CVE. That notice gives no score for CVE-2026-67279, so don’t borrow one from another CVE.
The chained result
Together, the first flaw gets an unauthenticated client into session handling and the second supplies the privileges. CERT Polska’s technical analysis says the chain could give full administrative access without a password, an SSH key or completed authentication. In its 5 September 2026 notice, CERT Polska put it this way: “Combining two of them allows an attacker to take full control of the device without authentication if the device supports remote access using the SSH protocol.”
Rank #2
- Wired Gigabit Router – 5x Gigabit Ethernet ports, 2.5G SFP, PoE-Out, USB, powered by RouterOS
Don’t conflate this chain with CVE-2026-67276. CERT Polska’s technical analysis treats that one as a separate SSH public-key authentication flaw. It belongs to the wider September RouterOS disclosure, not to this pair.
Which RouterOS versions are affected
CERT Polska’s record lists both CVEs as affecting RouterOS 6.x before 6.49.21, RouterOS 7.0.0 up to but not including 7.23.4, and RouterOS 7.24 up to but not including 7.24.2. MikroTik’s 3 September 2026 bulletin names the same fixes and also lists 7.25 beta 3 (CERT Polska vulnerability record; MikroTik bulletin).
| Branch or channel | First fixed version | How to read it |
|---|---|---|
| RouterOS 6.x (Long-term) | 6.49.21 | Anything older on the 6.x line is in the affected range. |
| RouterOS 7 (Long-term) | 7.23.4 | Affected range runs from 7.0.0 up to but not including 7.23.4. |
| RouterOS 7 (Stable) | 7.24.2 | Affected range in the 7.24 line is everything before 7.24.2. |
| Development | 7.25 beta 3 | Named by MikroTik. A beta is rarely the right choice for production edge gear when a supported fixed release exists on your branch. |
Fixed-version numbers are time-sensitive. Newer releases may have superseded them since the September disclosure, so check MikroTik’s current release information before choosing a target. Other September RouterOS CVEs have their own ranges. Don’t apply this table to them.
How exposed are you?
CERT Polska’s confirmed attacks targeted devices with SSH reachable from public networks. That is a report about an exposure condition, not a claim that every RouterOS installation is vulnerable or already compromised. No prevalence figure or victim count for these two CVEs appears in the sources consulted, so any quoted share of “all MikroTik devices” is unsupported.
Rank #4
- MikroTik RouterBOARD C52iG-5HaxD2HaxD-TC-US (US Version) hAP ax (WiFi6) Quad-Core IPQ-6010 864 MHz, RAM 1GB, RouterOS, License level 4 It's time to supercharge your home network with the Generation
- hAP ax has everything you might need in a primary home access point - and more
- Forget endless reviews and comparisons - this is the perfect device for 99% of homes
- Wireless signal is now stronger than ever
- Here are the two main ingredients of hAP ax's success: a state-of-the-art dual-band, dual-chain 4-4
MikroTik’s bulletin takes a narrower view. It says most configurations are not at risk and that regular home users face no immediate risk, but it still strongly recommends upgrading. The default configuration blocks SSH from the internet. If you opened SSH manually, MikroTik says to restrict it to trusted IP addresses. It also recommends a strong VPN such as WireGuard for administration and advises against exposing management ports at all (MikroTik bulletin).
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Triage order for a fleet
| Situation | Priority |
|---|---|
| Vulnerable version, SSH reachable from the internet | Highest. Restrict SSH now, upgrade, then review for compromise. |
| Vulnerable version, SSH open to a broad internal or partner network | High. Untrusted or semi-trusted hosts on those networks could still reach the service. |
| Vulnerable version, SSH limited to trusted addresses or VPN only | Upgrade in the normal urgent patch cycle. Exposure is reduced, not eliminated. |
| Fixed version already running | Verify the running version. If the device ran an affected build while SSH was reachable, still review it for earlier compromise. |
Response steps
- Inventory versions and exposure. Record each device’s RouterOS version and whether SSH is reachable from the internet or other untrusted networks. The Canadian Centre for Cyber Security recommends exactly this, with internet-exposed SSH systems first (Canadian Centre for Cyber Security alert). On a device,
/system resource printshows the installed version and/ip service printshows which services are enabled and which addresses may use them. - Cut untrusted SSH access immediately. Limit SSH and other management services to trusted addresses, or move administration behind a VPN, as MikroTik advises. This is a stopgap while you schedule the upgrade, not the fix.
- Upgrade to a fixed release for the device’s branch. Use 6.49.21, 7.23.4 or 7.24.2 (or a later release on your channel), then confirm the version that is actually running after the reboot. Vendor and government guidance both put updating first (MikroTik bulletin; Canadian Centre for Cyber Security alert). CERT Polska says updating to the latest fixed version prevents the attacks it observed.
- Review logs and configuration. Look at authentication logs and network activity. Then check the configuration for entries you don’t recognize: users, scripts, scheduler tasks, proxy servers and tunnels (CERT Polska exploitation notice; MikroTik bulletin). Commands such as
/user print,/system script print,/system scheduler printand/ip proxy printcover most of that list. - Act on any Flagged entry. If the log contains a critical message saying the device is Flagged, treat it as a possible compromise and follow MikroTik’s Flagged-status instructions in its bulletin.
Why a clean-looking router is not proof of safety
The Flagged mechanism catches selected traces of compromise, not every possible one. CERT Polska warns that the absence of a Flagged marker does not mean a device is safe (CERT Polska exploitation notice). That matters most for devices that ran an affected build with SSH exposed before you patched. Upgrading closes the hole, but it does not remove accounts, scripts, scheduled tasks or tunnels an attacker may already have planted. For those devices, the configuration review in step 4 is the real test. If you find something you can’t explain, treat the device as compromised, not just misconfigured.
Best Value
- W128339515
Does disabling public SSH protect the router?
It removes the exposure condition CERT Polska observed being attacked, so it is the right immediate move. It leaves three gaps. The vulnerable code is still present for anyone who can reach SSH from an allowed network. A device that was exposed earlier may already be compromised. And other September RouterOS flaws exist that this pair’s analysis doesn’t cover. Restrict access, patch and review. Doing only one of the three leaves a gap.
Source dates and limits
This article draws on MikroTik’s 3 September 2026 bulletin, CERT Polska’s 5 September vulnerability record and exploitation notice, the Canadian Centre for Cyber Security’s 10 September alert, and CERT Polska’s 22 September technical analysis. MikroTik’s bulletin initially withheld technical detail, so the mechanics above follow CERT Polska. Exploitation status and the latest fixed releases can change. Check MikroTik’s current release information before you act.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
