DIVD-2026-00012 - MikroTik RouterOS MikroTrick vulnerabilities

Summary

MikroTik has published fixes for multiple vulnerabilities in RouterOS that are collectively referred to as MikroTrick. The issues affect SSH authentication and privilege handling, and a separate bandwidth-test component.

The Netherlands National Cyber Security Centre (NCSC-NL) reports that CERT Polska has observed active exploitation against MikroTik routers where SSH is publicly accessible. In observed attacks, multiple vulnerabilities were combined to obtain full control of affected routers.

The vulnerabilities covered by this case are:

CVE-2026-67276 — SSH authentication bypass, CVSS v4 9.2. RouterOS did not correctly verify the exponent of RSA keys during SSH authentication. This can allow an attacker to forge an RSA signature and obtain unauthorized SSH access. CVE-2026-86060 — SSH privilege escalation, CVSS v4 9.2. Improper handling of usernames beginning with a prohibited character can affect the trusted policy mask during the SSH login process and allow privilege escalation. CVE-2026-67277 — RouterOS bandwidth-test vulnerability, CVSS v4 8.8. An unauthenticated client can start an IPv4 UDP bandwidth test that can trigger incorrect kernel packet handling. The reported impact includes kernel restarts and, according to public reporting, possible kernel-memory disclosure. MikroTik states that fixes are available in RouterOS 6.49.21, 7.23.4, 7.24.2 and 7.25 beta 3. The supplied vendor advisory does not provide a complete matrix of all affected versions, so we do not infer an affected-version range beyond the information published by MikroTik.

What you can do

Update RouterOS. Upgrade the device through the appropriate RouterOS update channel to a release containing the MikroTik fix. MikroTik lists 6.49.21, 7.23.4, 7.24.2 and 7.25 beta 3 as releases containing the fix. Restrict SSH exposure. Do not make SSH available to untrusted networks. If remote administration is required, restrict it to trusted source IP addresses or place management access behind a VPN such as WireGuard. Check the RouterOS log after upgrading. MikroTik states that RouterOS checks for signs of compromise and can mark a device as Flagged. If the log contains a critical entry indicating that the device is Flagged, follow MikroTik’s Flagged-status guidance. Review the configuration. Even when the device is not marked Flagged, inspect users, scripts and other RouterOS configuration for entries that you do not recognize. Treat signs of compromise as an incident. If unknown users, scripts or configuration changes are present, preserve relevant logs and configuration data and follow your incident-response process before returning the device to normal operation.

Timeline

What we are doing

DIVD is currently scanning for vulnerable Microtick appliances and notifying affected parties.