A firewall you never log into is still a device someone else can log into, and that is exactly what just happened to an unknown number of MikroTik routers.
A password check that forgets to check the password
CVE-2026-67276 lives in how RouterOS verifies SSH public keys. To accept a login, the system is supposed to confirm that the key presented matches the one on file, in full. Instead, RouterOS checks only the key type and the modulus, and skips the exponent. An attacker who already knows a valid username and the modulus of that user’s authorised key can forge a different key that RouterOS accepts anyway, and log in as that user without ever holding the real private key. CERT Polska, Poland’s national CSIRT, rates it CVSS 9.2 and coordinated the disclosure after confirming it was already being used in the wild.
From a foothold to root, in one more step
On its own, CVE-2026-67276 gets an attacker into a user account. Chained with CVE-2026-86060, a second flaw in how RouterOS handles crafted usernames during SSH login, it gets them all the way to administrative control of the device. CERT Polska named the combined chain MikroTrick. Because both steps run over SSH, any RouterOS device with SSH reachable from the public internet, which describes a large share of small business and branch-office routers deployed with default management access left open, is a candidate for full takeover with no credentials at all.
The window between patch and disclosure was already closed
MikroTik shipped fixed builds, including 7.24.2, 7.23.4 and 6.49.21, on September 3. CERT Polska published its advisory two days later, on September 5, and noted that exploitation attempts against internet-facing devices had already been observed from at least September 2, meaning attackers were working from the vulnerability before the coordinated disclosure ever went public. CISA added the RouterOS flaws to its Known Exploited Vulnerabilities catalog on September 10, alongside a related btest service flaw tracked as CVE-2026-67277, and set September 13, today, as the deadline for US federal agencies to remediate. That sequence, quiet exploitation ahead of a defensive advisory, is becoming the norm for edge network devices rather than the exception.
What to check today
If your organisation, or a client’s, runs MikroTik hardware at a branch office, a data centre edge, or as a VPN concentrator, confirm the RouterOS version now rather than at the next maintenance window. If SSH management is reachable from the internet on any of those devices, that exposure needs closing regardless of patch status, since MikroTrick is exactly the kind of chain that keeps working until the underlying practice, exposed management interfaces, changes.
If you want a European team to audit which of your edge devices are internet-facing, confirm your MikroTik fleet is patched, and tighten management access so the next router flaw does not become a full network compromise, contact Excello Digital. We help organisations find and close exactly this kind of exposure before attackers do.