iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes: CERT Polska reported confirmed attacks using CVE-2026-67279 and CVE-2026-86060 together against MikroTik RouterOS devices with SSH reachable from public networks. If you administer a MikroTik router, identify its RouterOS branch, install the corresponding fixed release, restrict management access, and check logs and configuration for signs of compromise. Disabling public SSH reduces exposure, but it does not replace updating or investigating a device that may already have been accessed.
How the two RouterOS flaws work together
CERT Polska calls the combined attack chain “MikroTrick.” The CVEs address different stages of an SSH connection: CVE-2026-67279 creates an unauthenticated path into channel handling, while CVE-2026-86060 can manipulate the policy mask used by the SSH login path. According to CERT Polska’s technical analysis, chaining them enabled full administrative access without a password, SSH key, or completed authentication.
CVE-2026-67279: authentication-state handling
During a client-initiated SSH rekey before user authentication had completed, affected RouterOS builds could move into connection and channel handling rather than resume authentication. An unauthenticated client could then create a session channel and send requests such as exec. CERT Polska describes this as a prerequisite for the second flaw, not a flaw that by itself authenticated the attacker or granted privileges. See its analysis and vulnerability record.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
CVE-2026-86060: SSH login argument handling
A crafted username beginning with a prohibited character could affect how RouterOS’s SSH login helper interpreted arguments and changed the trusted RouterOS policy mask. MikroTik’s fixed builds validate the username before passing it to the login application, according to CERT Polska’s record and technical analysis.
#1 Best Overall
- hEX also known as RB750Gr3 is a five port Gigabit Ethernet router for locations where wireless connectivity is not required
- The device has a full size USB port. This new updated revision of the hEX brings several improvements in performance
- It is affordable, small and easy to use, but at the same time comes with a very powerful dual core 880MHz CPU and 256MB RAM
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude
- Dimensions: 113x89x28mm; Storage size: 16 MB; Passive PoE (PoE in); PCB temperature monitor, Voltage monitor and Mode button
This chain is distinct from CVE-2026-67276, a separate SSH public-key authentication flaw identified in the same period. CERT Polska explicitly distinguishes that issue in its analysis; it is not one of the two flaws discussed here.
Is the combined chain being actively exploited?
Yes. In its 5 September 2026 notice, CERT Polska said it had confirmed attacks using the combined MikroTrick chain to take full control of devices whose SSH service was accessible from public networks. That is a report about the combined chain and the observed exposure condition—not evidence that every RouterOS device is vulnerable or compromised. CERT Polska’s exploitation notice says updating to a fixed version prevents the observed attacks.
Rank #2
- Wired Gigabit Router – 5x Gigabit Ethernet ports, 2.5G SFP, PoE-Out, USB, powered by RouterOS
MikroTik said most configurations were not at risk and that regular home-device users faced no immediate risk, while still strongly recommending an upgrade. Its September 2026 bulletin says the default configuration blocks SSH from the internet. Administrators who opened SSH themselves should limit it to trusted IP addresses; for remote administration, MikroTik recommends strong VPN access, such as WireGuard, rather than exposing management ports.
Free tools Windows power users keep installed
One-click scans. No signup required.
Which RouterOS versions are affected, and what fixes them?
CERT Polska lists both CVEs as affecting the following ranges. The fixed releases below are branch-specific; check the device’s installed branch and MikroTik’s current release guidance before upgrading, because supported releases can change.
Rank #3
| RouterOS branch or channel | Affected range listed by CERT Polska | Fixed version listed |
|---|---|---|
| 6.x / Long-term | Versions before 6.49.21 | 6.49.21 |
| 7 Long-term | 7.0.0 through versions before 7.23.4 | 7.23.4 |
| 7 Stable | 7.24 through versions before 7.24.2 | 7.24.2 |
| Development | Not stated as an affected range | 7.25 beta 3, also listed by MikroTik |
The affected ranges and stable/long-term fixes are from CERT Polska’s vulnerability record; MikroTik also names 7.25 beta 3 in its bulletin. A beta is not automatically the right operational choice for a production router: choose a fixed release appropriate to the device’s branch and current support status rather than moving to a development channel solely because its version number is higher.
Quick Recap
Best Value
- W128339515
Rank #4
- MikroTik RouterBOARD C52iG-5HaxD2HaxD-TC-US (US Version) hAP ax (WiFi6) Quad-Core IPQ-6010 864 MHz, RAM 1GB, RouterOS, License level 4 It's time to supercharge your home network with the Generation
- hAP ax has everything you might need in a primary home access point - and more
- Forget endless reviews and comparisons - this is the perfect device for 99% of homes
- Wireless signal is now stronger than ever
- Here are the two main ingredients of hAP ax's success: a state-of-the-art dual-band, dual-chain 4-4
What administrators should do
- Inventory versions and exposure. Identify each RouterOS version and determine whether SSH is reachable from the internet or another untrusted network. The Canadian Centre for Cyber Security advises checking appliance versions and prioritizing systems with internet-exposed SSH in its alert.
- Upgrade to a fixed, supported release for that branch. Follow MikroTik’s current release guidance, then verify that the router is running the intended version. See the MikroTik bulletin and the Canadian Centre’s update guidance.
- Restrict management access. Do not expose SSH or other management ports to untrusted networks. Limit access to trusted IPs, or use a VPN such as WireGuard for remote administration, as described in MikroTik’s bulletin.
- Review logs and configuration. Look for suspicious authentication events and network activity, and inspect for unfamiliar users, scripts, scheduler tasks, proxy servers, tunnels, or other unrecognized entries. These checks are recommended by CERT Polska, MikroTik, and the Canadian Centre for Cyber Security.
- Escalate a Flagged device. If a critical log entry says the device is Flagged, treat it as a possible compromise and follow MikroTik’s Flagged-status instructions in its bulletin. A missing Flagged marker does not prove a device is clean: CERT Polska says the mechanism identifies selected traces, not every possible compromise, in its notice.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
