Vulnerability
Identifier for an SSH authentication bypass in MikroTik RouterOS arising from flawed RSA public-key verification, scored CVSS 9.2.
CERT Polska disclosed MikroTrick, a chain of two RouterOS flaws that gives unauthenticated admin on routers whose SSH faces the internet. Attacks were already under way at disclosure. Reachable SSH is the one condition the chain needs.
Reality
CISA says an integer underflow in MikroTik RouterOS web management gives an unauthenticated attacker root with one crafted request on versions below 7.24. No exploitation has been reported, but MikroTik's fix advice sets a 7.23 floor that CISA's own affected range still covers.
Perspective Coverage
3 publishersReality
CERT Polska dated successful attacks to at least September 2 and published its warning on September 5, so operators who deferred the RouterOS update have three days of configuration changes to read as well as a patch to install.
Perspective Coverage
8 publishersReality
MikroTik published RouterOS fixes in four branches with no CVE and no technical detail. The same upgrade runs a compromise check and writes a critical log entry marking the device Flagged.
Perspective Coverage
3 publishersReality
CERT Polska's breakdown of the September RouterOS compromises names two bugs, CVE-2026-67279 and CVE-2026-86060, and the forum logs that match the chain start on September 2, a day before MikroTik shipped fixes.
Reality
CERT Polska confirmed exploitation of the MikroTrick chain on September 5, and the two bugs need no password and no private key, only a reachable SSH service, so the firewall rule scopes the risk before any build audit can.
Reality
Two RouterOS flaws published to NVD on 2026-09-05 both sit in code that runs before a session has proven who it is. An upgrade closes them. Which management services answer from the internet is still an open question.
Reality
CERT Polska reports active exploitation on internet-facing MikroTik routers, where the chain needs no private key and no user interaction, and the fixed builds close the bypass without explaining how attackers learned the account details.
Reality