Active Exploitation of Critical Vulnerabilities in MikroTik Routers (CVE-2026-67276, CVE-2026-86060)

Attackers are actively exploiting a chain of vulnerabilities known as 'MikroTrick' in MikroTik RouterOS routers with the SSH service exposed to the Internet. CERT Polska and expert Costin Raiu revealed that the attacks combine SSH authentication bypass (CVE-2026-67276, CVSS 9.2) and privilege escalation (CVE-2026-86060) to gain full administrative control without credentials. Once the devices are compromised, the hackers create a user account named '-2' to maintain persistent access even after patches are applied. Users are urged to immediately upgrade to RouterOS 7.24.2, 7.23.5, or 6.49.21 and check their system logs for unauthorized access.

Source: SANS Internet Storm Center