Author: DigitalSpying Security Desk
Date: September 13, 2026
Executive Summary
Edge routing infrastructure across global telecommunications and enterprise networks is facing widespread automated compromise following the disclosure and in-the-wild weaponization of an exploit chain dubbed MikroTrick. Investigated by CERT Polska and reported by The Hacker News and Triskele Labs, the attack chain targets MikroTik RouterOS by combining an improper cryptographic signature verification flaw (CVE-2026-67276) with a command argument injection defect in the SSH login helper (CVE-2026-86060).
The exploit allows an unauthenticated remote attacker with access to a router's SSH port to forge valid authentication keys, alter the device's security policy mask, and seize full root-level administrative control. With the Shadowserver Foundation tracking more than 122,500 internet-facing RouterOS devices exposed to attack, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency mandate adding the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
Deep-Dive Technical Analysis
1. The MikroTrick Exploit Chain Architecture
The MikroTrick attack chain achieves complete, unauthenticated administrative takeover through a two-stage exploitation pipeline targeting RouterOS's SSH service:
Stage 1: SSH Cryptographic Signature Forgery (CVE-2026-67276)
* Vulnerability Classification: Improper Verification of Cryptographic Signature (CWE-347, CVSS 9.2).
* The Cryptographic Flaw: During SSH public-key authentication, RouterOS inspects the user's supplied RSA public key against authorized accounts. However, the RouterOS validation logic inspects only the key type and the mathematical modulus ($n$), completely failing to validate the public exponent ($e$).
* The Exploit Primitive: Because signature verification uses parameters from the client-supplied key packet, an attacker who knows a valid username and that user's public modulus ($n$) can craft an RSA public key containing that legitimate modulus but setting the public exponent to $e=1$. With $e=1$, signature verification collapses mathematically: the signature is equal to the plaintext hash itself ($S \equiv m^1 \pmod n$). The attacker signs their own authentication payload without ever possessing the victim's private key, opening an authenticated SSH session as that user.
Stage 2: Login Helper Argument Injection & Policy Escalation (CVE-2026-86060)
* Vulnerability Classification: Improper Neutralization of Argument Delimiters in a Command (CWE-88, CVSS 9.2).
* Privilege Escalation: Once the SSH channel is opened in the pre-authenticated state, the attacker passes a crafted username beginning with prohibited command delimiter characters (e.g., -2 or --policy).
* Mishandling by Login Helper: RouterOS's internal SSH login helper interprets the specially formatted username string as command-line argument switches rather than an identity string. This argument injection directly overrides the session's security policy mask, elevating the unprivileged session to unrestricted administrative (read,write,policy,test,password) rights.
Independent Flaw: Bandwidth-Test Memory Leak (CVE-2026-67277)
In addition to the SSH takeover chain, researchers disclosed CVE-2026-67277 (CVSS 8.8):
* The RouterOS bandwidth-test (btest) service accepts unauthenticated connections before session handshake completion.
* A packet-size integer underflow allows remote attackers to leak kernel memory structures or trigger an immediate kernel panic, causing denial-of-service.
2. Timeline and In-The-Wild Attack Signatures
Forensic telemetry indicates that threat actors were actively exploiting MikroTrick prior to public disclosure:
* Zero-Day Exploitation Window: CERT Polska confirmed active attacks began on September 2, 2026—before patches were published on September 3 and days before coordinated public disclosure on September 5.
* Threat Actor Telemetry: Successful intrusions originated from confirmed attacker infrastructure, including IP addresses 82.192.72[.]4 and 103.102.31[.]18.
* Post-Exploitation Persistence: Threat actors immediately generate backdoor administrative user accounts (predominantly named ops), alter NAT and DNS proxy settings to intercept transit traffic, and establish encrypted WireGuard tunnels for long-term network persistence.
Release Branch
Vulnerable Versions
Remediated Release
RouterOS 6.x (Long-term)
6.0.0 through 6.49.20
6.49.21 (Long-term)
RouterOS 7.x (Long-term)
7.0.0 through 7.23.3
7.23.4 (Long-term)
RouterOS 7.24.x (Stable)
7.24.0 through 7.24.1
7.24.2 (Stable)
Industry Impact & ISP Threat Assessment
MikroTik hardware is ubiquitous as Customer Premises Equipment (CPE), enterprise gateway routers, and core ISP infrastructure:
* Global Blast Radius: Over 122,500 internet-facing RouterOS SSH endpoints were actively reachable when exploitation began.
* Traffic Interception & Wiretapping: Because compromised routers operate at the network boundary, attackers can passively mirror unencrypted transit traffic, execute DNS redirection (BGP hijacking), and capture internal network credentials.
* Botnet Enlistment: Hijacked MikroTik devices are historically prized by DDoS syndicates (such as Meris and Mēris-derived botnets) due to their high bandwidth and hardware-accelerated routing throughput.
Actionable Recommendations & Compromise Assessment
1. Mandatory Firmware Upgrade
Organizations must upgrade all RouterOS devices immediately to verified releases: 6.49.21, 7.23.4, or 7.24.2.
* Crucial Caveat: Fixed builds include an internal startup scan for known MikroTrick artifacts that surfaces a "Flagged" status under /system/device-mode/print. A flagged status confirms compromise, but a clean status does not rule out novel modifications.
2. Forensic Compromise Assessment
Because active zero-day exploitation occurred prior to patch availability, administrators must conduct a compromise assessment:
* Inspect User Accounts: Run /user/print to look for unrecognized administrative users, especially accounts named ops or usernames beginning with -.
* Audit System Scripts & Schedulers: Review /system/script/print and /system/scheduler/print for unauthorized persistence scripts or cron-like tasks.
* Verify DNS & Proxy Settings: Inspect /ip/dns/print and /ip/firewall/nat/print to ensure traffic is not being redirected to external attacker proxies.
3. Edge Perimeter Hardening
* Disable Public SSH Exposure: Internet-facing access to SSH (TCP 22), WinBox (TCP 8291), and web interfaces (TCP 80/443) must be disabled immediately.
* Out-of-Band & VPN Management: Restrict management interfaces strictly to isolated management VLANs or enforce access exclusively through authenticated VPN tunnels.
Sources and Reference Intelligence: CERT Polska Threat Bulletin, The Hacker News, Triskele Labs Advisory, CISA Known Exploited Vulnerabilities Catalog.