Active Exploitation of MikroTik Routers Confirmed
Security researchers have confirmed active, in-the-wild exploitation of a critical vulnerability chain affecting MikroTik routers running RouterOS. The attack, nicknamed MikroTrick, chains together two flaws: CVE-2026-67276, an SSH authentication bypass, and CVE-2026-86060, a privilege escalation bug that lets attackers escalate an SSH session to full administrative control. Together, the two vulnerabilities allow an attacker to gain complete access to a vulnerable router without needing valid credentials.
This isn't a theoretical risk. Reporting indicates exploitation has been ongoing since early September, and researchers have identified more than 122,500 MikroTik devices that expose their SSH management port directly to the internet, making them reachable targets for automated scanning and attack tools. Once compromised, routers can show a telltale sign: an unauthorized "SSH user 2" account added by attackers, a quiet but visible fingerprint of the intrusion.
How the MikroTrick Attack Chain Works
Routers are attractive targets precisely because they sit at the edge of a network, routing every packet of traffic that flows in and out of a home or business. A compromised router doesn't just expose the device itself; it can give an attacker a foothold to intercept traffic, redirect DNS queries, pivot into internal networks, or enlist the device into a botnet for larger attacks like distributed denial-of-service campaigns.
The MikroTrick chain is particularly concerning because it targets SSH, a protocol administrators rely on specifically because it's supposed to be secure. By bypassing authentication entirely and then escalating privileges within the session, attackers skip the usual friction of guessing passwords or exploiting weak credentials. Any RouterOS device with SSH exposed to the public internet and running an unpatched version is a potential target.
MikroTik has released fixes addressing the flaws, with patched versions available for RouterOS 7.24.2, 7.23.5, and 6.49.21. Administrators running older or unpatched builds remain exposed until they update.
Why This Matters for Privacy, Not Just Network Security
It's easy to think of router vulnerabilities as an IT problem for network administrators, but the privacy implications reach much further. A router is the single point through which all of a household's or business's internet traffic passes. When it's compromised, an attacker can potentially observe unencrypted traffic, manipulate DNS to redirect users to malicious sites, or use the device as a launchpad for surveillance and further intrusion into connected devices like laptops, smart home gadgets, and security cameras.
This kind of infrastructure-level compromise mirrors a broader pattern seen across the threat landscape, where attackers increasingly target the tools people trust to keep them safe. Just as state-sponsored actors have exploited zero-day flaws in widely used software to target specific groups, opportunistic and financially motivated attackers are exploiting router-level zero-days at scale, going after any exposed device rather than a single target. The MikroTrick campaign appears to fall into this latter category: broad, automated exploitation of any internet-facing device left vulnerable.
What This Means for You
If you or your organization use MikroTik routers, the first step is checking whether SSH management is exposed to the public internet. For most home and small business setups, there's rarely a good reason to leave SSH open to the wider internet at all; it should be restricted to trusted internal networks or accessed only through a VPN tunnel.
Next, confirm your RouterOS version. If you're not running 7.24.2, 7.23.5, 6.49.21, or later, updating should be treated as urgent, not optional. Given that exploitation is already underway, unpatched devices are actively being targeted right now, not just theoretically at risk.
Finally, check your device for signs of compromise, particularly unfamiliar user accounts such as an unexpected "SSH user 2" login, which researchers have flagged as an indicator tied to this specific attack chain. If you find evidence of unauthorized access, a factory reset combined with a fresh, patched installation is the safest path forward, along with rotating any credentials that may have been exposed.
Actionable Takeaways
MikroTik router owners should treat this as a call to action rather than a distant threat. Update RouterOS to a patched version immediately, disable or restrict SSH access from the public internet, and inspect device logs and user accounts for signs of tampering. Network administrators managing fleets of MikroTik devices should prioritize auditing internet-facing management interfaces across their entire deployment, since a single exposed router can undermine the security of an otherwise well-protected network. Staying current with patches and minimizing unnecessary internet exposure remain the most effective defenses against this and future router-focused exploitation campaigns.
