122,500 MikroTik routers exposed: what MikroTrick tells us about unauthenticated RCE at scale
CERT Polska published its MikroTrick advisory on September 7, 2026, disclosing active exploitation of a two-vulnerability chain in MikroTik RouterOS that allows any unauthenticated attacker with SSH reachable from the internet to obtain full administrative control of the device.
The numbers are not small. Shadowserver counted 122,500 internet-facing RouterOS SSH instances in a single scan window on September 5, two days after patches were released and three days after exploitation began.
The vulnerability chain
MikroTrick chains two CVEs.
CVE-2026-67276 exploits a flaw in how RouterOS handles RSA key verification. An attacker who can observe or enumerate an authorized user's RSA modulus can forge a valid key and authenticate as that user without possessing the private key. The flaw lies in an incomplete validation step during SSH handshake.
CVE-2026-86060 is a privilege escalation vulnerability in RouterOS's SSH session handling. A malformed username string tricks the login process into accepting forged authentication data as proof of administrative rights.
Combined, the chain gives an unauthenticated remote attacker administrative control via SSH. No credentials required. No user interaction required beyond the device being reachable.
Timeline
Exploitation began on approximately September 2, 2026. MikroTik released patched RouterOS builds on September 3: version 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable). CERT Polska published its advisory on September 7. Shadowserver's scan on September 5 found 122,500 exposed devices.
The one-day gap between exploitation start and patch availability is significant. Any organization with internet-facing MikroTik SSH that had not patched by September 3 was in the exploitation window from day one.
What attackers are doing with it
Post-exploitation activity has not been uniformly attributed to a single actor or campaign. Given the device type (network infrastructure), likely use cases include persistent access for further pivoting, traffic interception on ISP or branch-office networks, and botnet recruitment for DDoS or proxy infrastructure. MikroTik devices have historically been recruited into Meris and other large-scale botnets.
How to detect compromise
CERT Polska and the security community have identified one reliable indicator of compromise: check SSH users on the device. Compromised routers frequently show an SSH user named "-2" that was not added by the legitimate administrator. This is a post-exploitation persistence mechanism.
Check with: /user print in the RouterOS terminal. Any user whose name starts with "-" or consists only of "-2" is suspicious and should be treated as a compromise indicator.
What to do
Patch immediately to RouterOS 6.49.21, 7.23.4 long-term, or 7.24.2 stable. Disable SSH access from the internet if it is not required for your operational use case. Apply firewall rules to restrict SSH to known management IPs. Check all devices for the "-2" user indicator. If found, treat the device as compromised: rotate all credentials, check connected network segments for lateral movement, and rebuild from a clean configuration.
The broader point
MikroTik equipment is pervasive in ISP infrastructure, enterprise branch offices, and small business networks across Central and Eastern Europe, Central Asia, and beyond. Vulnerabilities in RouterOS carry outsized risk because of the volume and diversity of deployment contexts.
MikroTrick is a reminder that network devices are software, and software has bugs. They need patching on the same cadence as servers and endpoints.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you manage critical network infrastructure and want to discuss exposure assessment.