MikroTik RouterOS Authentication‑Bypass and Privilege‑Escalation Flaws Enable Remote Takeover
What Happened — Attackers are actively exploiting two newly disclosed CVEs (CVE‑2026‑67276 and CVE‑2026‑86060) in MikroTik RouterOS. The first flaw bypasses SSH authentication by abusing RSA key handling; the second escalates the attacker to full administrator via a crafted username. Together, the “MikroTrick” chain lets an adversary seize a router that is reachable from the Internet without providing a password.
Why It Matters for Trust & Control Assurance
- It shows that password‑only controls are insufficient; continuous verification of authentication and privileged‑access mechanisms is a core control‑objective.
- Real‑time evidence that remote‑management interfaces are locked down and that any privileged‑access change is logged is essential for a defensible audit trail.
- The scenario maps directly to the control objective of enforcing strong authentication and privileged‑access management for edge devices, a requirement that satisfies many frameworks (e.g., NIST CSF 2.0 ID.AM‑1).
Who Is Affected — Any organization that deploys MikroTik routers for branch, WAN, or IoT connectivity—spanning enterprises, service providers, and public‑sector networks.
Recommended Actions
- Apply the latest RouterOS security update immediately via the built‑in update mechanism or the official MikroTik download site.
- Remove public Internet access to SSH and other management services; restrict access to known IP ranges or use a VPN.
- Enable MikroTik’s startup detection flag, audit any flagged configuration changes before clearing, and retain logs as evidence.
- Integrate automated configuration‑drift monitoring into your continuous control‑assurance program to prove that management ports remain closed. Source: https://www.malwarebytes.com/blog/news/2026/09/mikrotik-routers-can-be-taken-over-without-password
Technical Notes — CVE‑2026‑67276 is an SSH authentication‑bypass vulnerability in RSA public‑key handling; CVE‑2026‑86060 is a privilege‑escalation flaw triggered by a specially crafted username during SSH login. Both require the router’s SSH service to be exposed to the Internet. Source: same URL