Table of Contents
Introduction
Attackers are exploiting MikroTik routers with internet-exposed SSH to gain full administrative control without authentication, according to an attack warning published by CERT Polska on September 5, 2026.
This is a critical security threat for organizations and individuals using MikroTik RouterOS devices. Attackers can gain full administrative control over affected routers without needing any credentials, potentially leading to network compromise, data theft, and further attacks.
Attackers are gaining full administrative control over MikroTik routers through internet-exposed SSH without any authentication. This affects a wide range of RouterOS versions.
What Is Happening?
CERT Polska has issued an urgent warning about attackers actively exploiting a vulnerability chain in MikroTik routers. The attackers are able to bypass authentication and gain full administrative access through internet-exposed SSH services.
Key details:
- Attack method: Exploitation of internet-exposed SSH without authentication
- Attack start date: At least September 2, 2026
- Vulnerability chain: Referred to as "MikroTrick" by CERT
- Impact: Full administrative control over affected routers
- Victim count: Not yet disclosed
- Attacker identity: Unknown
The vulnerability chain has been named "MikroTrick" by CERT Polska. The exact combination of two flaws that enable the attack has not been publicly detailed.
Default firewall protection:
- Home MikroTik devices block public access to management ports when default firewall rules remain intact
- However, if the firewall is modified or disabled, routers become vulnerable
Affected MikroTik RouterOS Versions
CERT Polska has identified a wide range of affected RouterOS versions. The following table shows the affected versions and the corresponding fixed releases:
| Affected Range | Initial Security Fix | Update Guidance |
|---|---|---|
| From 6.0.0 below 6.49.21 | 6.49.21 | RouterOS 6 security release |
| From 7.0.0 below 7.23.4 | 7.23.4 | Use 7.23.5 on the long-term channel |
| From 7.24 below 7.24.2 | 7.24.2 | Stable channel security release |
| No development range listed | 7.25beta3 | Development channel fix |
The 7.23.5 regression fix addresses an IPv6 DHCP problem introduced in 7.23.4 while retaining the security update.
How the Attack Works
While the exact technical details of the vulnerability chain remain undisclosed, CERT Polska has provided the following information:
- Two vulnerabilities are being chained together
- The combination allows attackers to bypass authentication
- Attackers gain full administrative control over the router
- The attack works through internet-exposed SSH services
Attack stages:
- Attacker identifies a MikroTik router with SSH exposed to the internet
- Attacker exploits the vulnerability chain to bypass authentication
- Attacker gains full administrative access without credentials
- Attacker can modify configuration, create accounts, and deploy malware
The attacker does not need credentials to gain administrative access. Any MikroTik router with internet-exposed SSH and an affected version is at risk.
Signs of Compromise
CERT Polska has identified several indicators of compromise (IOCs) that administrators should look for:
- Highly privileged ops accounts — unexpected admin-level accounts
- Account-creation logs containing
ssh:-2@in the logs - Unknown users — accounts that you did not create
- Unrecognized scripts — scripts that you did not install
- Unexpected configuration changes — settings that have been modified
How to check for compromise:
- Check the logs — review system logs for suspicious activity
- Run the command —
/system/device-mode/printto inspect the device status - Look for Flagged status — RouterOS flags a device when startup checks detect suspicious configuration
- Inspect the configuration — check for unknown users, scripts, and other unrecognized changes
CERT also points to unexpected highly privileged ops accounts and account-creation logs containing ssh:-2@ as signs to investigate.
What to Do Immediately
If you have a MikroTik router, take these steps immediately:
1. Update RouterOS
- Check your RouterOS version against the affected versions table above
- Install the latest security release for your version channel
- Use the official RouterOS downloads from MikroTik's website
2. Restrict Access to Management Services
- Turn off exposed services or restrict access to trusted management networks
- Particularly focus on:
- SSH — Secure Shell
- WWW/WWW-SSL — Web management interfaces
- Bandwidth-test — Testing services
3. Avoid Risky Actions
- Do not initiate TLS connections from an unpatched device
- Do not use RouterOS's built-in SSH clients from an unpatched device
These temporary restrictions cover the broader set of vulnerabilities and do not replace the update. You must update as soon as possible.
Recovery Steps if Compromised
If you suspect your router has been compromised, CERT Polska recommends the following recovery steps:
Step 1: Isolate and Preserve
- Isolate the router from the network
- Preserve logs and configuration before resetting
- Export and download the files (CERT's preservation guide explains how)
- Do not clear Flagged before preserving evidence and completing analysis
Step 2: Reset and Rebuild
- Restore factory settings
- Rebuild using a trusted, verified configuration
- Do not blindly restore a full backup from the potentially compromised device
Step 3: Update Credentials
- Change passwords for all accounts
- Regenerate keys and other secrets in use
- Ensure all credentials are strong and unique
If the warning, logs, or configuration suggest compromise, follow these recovery steps. Do not clear Flagged before preserving the evidence and completing the analysis.
MikroTik's History of Security Issues
MikroTik routers have been targeted by attackers multiple times over the years. The current "MikroTrick" vulnerability chain is the latest in a series of security issues:
- 2023 — Multiple vulnerabilities patched in RouterOS
- 2024 — Attackers exploited MikroTik routers for DDoS attacks
- 2025 — Several security updates released for critical flaws
- 2026 — "MikroTrick" vulnerability chain actively exploited
MikroTik routers are popular in both home and enterprise environments. Their security posture is critical for network security.
Final Thoughts
The active exploitation of MikroTik routers through internet-exposed SSH without authentication represents a critical security threat. With attackers actively scanning for vulnerable devices since at least September 2, 2026, organizations and individuals must take immediate action.
Key takeaways:
- Critical vulnerability — attackers gain full admin control without credentials
- Wide impact — affects RouterOS versions 6.x and 7.x
- Fix available — update to 6.49.21, 7.23.4, 7.23.5, 7.24.2, or 7.25beta3
- Workaround — restrict SSH, WWW, and bandwidth-test access
- Check for compromise — look for unknown users, scripts, and configuration changes
- Recovery — isolate, preserve evidence, factory reset, and rebuild
If your organization uses MikroTik routers and needs assistance with security assessment, patching, or recovery, contact SystemLogicIT for expert guidance.