This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] MikroTik fixes 6 vulnerabilities, including the MikroTrick chain

MikroTik fixes 6 vulnerabilities in RouterOS in versions 7.24.2, 7.23.4 and 6.49.21, 3 of which (described below) can be chained and exploited to take complete control of the machine [1][2][3]. According to MikroTik, these chainable vulnerabilities are being actively exploited [2]. The remaining vulnerabilities can be found at [1]. If the machine has been accessed without authorization, it may be marked by the "Flagged" mechanism - more details at [4]. This mechanism alone cannot be relied upon, and other possible signs of compromise must also be checked, e.g. reviewing logs for suspicious strings and unknown changes in the file system. Known IoCs can be found at [2]. If updating is not possible, as a temporary mitigation it is possible to restrict access to the device's publicly accessible ports to trusted IP addresses only, not to create TLS connections from non-updated devices, and not to use the built-in SSH client [2].

MikroTik - authentication bypass (CVE-2026-67279)
CVSS 6.9 (Medium)

When attempting to use the rekey functionality, an unauthenticated remote attacker can establish a connection with the server and send a command execution request, which may cause unauthorized creation and modification of files, including configuration files [1].

The vulnerability is present in product:

  • MikroTik RouterOS; >=7.24, <7.24.2; >=7.0.0, <7.23.4; >=6.0.0, <6.49.21;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 5. 9. 2026.

MikroTik - SSH key falsification (CVE-2026-67276)
CVSS 9.2 (Critical)

Due to insufficient RSA key verification, an unauthenticated remote attacker who knows the victim's username and public RSA key modulus can open a connection with the ability to enter commands and perform actions on behalf of the victim [1]. A PoC is available at [5].

The vulnerability is present in product:

  • MikroTik RouterOS; >=7.24, <7.24.2; >=7.0.0, <7.23.4; >=6.0.0, <6.49.21;

CVSS: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 5. 9. 2026.

MikroTik - privilege escalaiton (CVE-2026-86060)
CVSS 9.2 (Critical)

An unauthenticated remote attacker can use a specially crafted username to escalate privileges to full administrator access in RouterOS. To exploit this vulnerability, an open unauthenticated SSH session with access to the RouterOS login helper functionality on the affected machine is required, which can be obtained by exploiting vulnerabilities CVE-2026-67279 or CVE-2026-67276 [1][2].

The vulnerability is present in product:

  • MikroTik RouterOS; >=7.24, <7.24.2; >=7.0.0, <7.23.4; >=6.0.0, <6.49.21;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

  • CVE-2026-86060 at cve.org, NVD
  • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 5. 9. 2026.

By CESNET, z.s.p.o. Martin Krajči on 7. 9. 2026.

CESNET, z.s.p.o. Logo