MikroTrick: AI-Found RouterOS Flaws Let Attackers Hijack Your Edge Router With Just a Username

A Polish CERT researcher found the bug with an AI model’s help, and within days attackers were using it against internet-exposed MikroTik routers. If your branch office runs on one, patch this week.

MikroTik gear is the quiet backbone of a lot of African networks. Internet service providers in Johannesburg, retail chains with fifty branches in KwaZulu-Natal, schools wiring up their first fibre line. RouterOS is everywhere because it is cheap, flexible, and runs on almost anything. That install base just became a target.

Poland’s CERT (NASK) disclosed an exploit chain it calls MikroTrick that combines two flaws in RouterOS SSH handling. Together they let an attacker who can reach your SSH port walk in with nothing but a username and take full administrative control of the router.

How the chain works

The first flaw, CVE-2026-67276, is an authentication bypass caused by incomplete validation of RSA public keys. Here is the plain version: if an attacker knows your username and the public half of your SSH key, they can forge a different key that the router accepts. The private key never enters the picture. All the math that makes SSH logins trustworthy falls apart at the validation step.

The second flaw, CVE-2026-86060, is a privilege escalation triggered by specially crafted usernames. Even a login that starts with limited rights can be manipulated into a full admin session. Chain the two, and a random scanner on the internet becomes the new owner of your edge router.

NASK found both bugs with assistance from AI models (GPT-5.5-cyber and GPT-5.6-sol) and rated them critical. The agency says exploitation began within days of disclosure and is continuing.

Why owning your router matters more than owning your server

A router sits between you and everyone else. Once an attacker controls it, they can:

• Redirect traffic for every device behind it, including payment terminals and VPN clients
• Silently capture credentials flowing to sites that still use HTTP
• Pivot into branches that trust the router’s network position
• Modify routing so your traffic takes a detour nobody approved

There is a third flaw worth knowing about, CVE-2026-67277, in RouterOS’s bandwidth-test service. It lets an unauthenticated attacker leak kernel memory or crash the device remotely. It is not part of the takeover chain, but it turns your router into a denial-of-service weapon against your own sites.

The numbers you should care about

MikroTik shipped fixes on September 3 in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, and NASK validated them. The vendor confirmed that not every configuration is exposed but withheld details, which buys attackers time while defenders guess at their own risk.

ShadowServer counted roughly 122,500 MikroTik devices with SSH reachable from the internet as of September 5. That is the attack surface, though not all of it is vulnerable. The updated RouterOS adds a compromise detector that looks for known signs of unauthorized configuration changes at startup, disables malicious entries, and logs a critical warning. NASK’s caution stands: the absence of a marker is not proof you are clean.

What to do before Friday

1. Upgrade now. Any RouterOS box reachable from the internet goes to 7.24.2 or 6.49.21 immediately. Older branches can wait hours, not weeks.
2. Close SSH to the internet. If you cannot patch today, restrict SSH, WWW/WWW-SSL, and the bandwidth-test service to management IPs, or disable them. Most exposed admin planes exist out of habit, not need.
3. Assume compromise if you were exposed during the patch window. NASK’s guidance: isolate the router, preserve logs and configuration for forensics, factory reset, rebuild from a trusted configuration, and rotate every password and key that lived on the device.
4. Check the config diff. Rogue admin accounts and altered routing rules are the fingerprints MikroTrick leaves behind.

The eHawu view

MikroTrick is a reminder that the perimeter was never the firewall box alone. It is every device that speaks to the internet on your behalf, and most businesses have no idea how many of them do. eHawu’s network-layer monitoring watches exactly this class of exposure: it inventories what is reachable from outside, flags admin services that should never face the public internet, and alerts the moment routing behavior shifts without a change ticket. If you want to know whether your branch routers are on the 122,000 list, that is the conversation to start.