Hackers exploit new MikroTik RouterOS flaws to hijack routers

Hackers are actively exploiting a chain of two critical vulnerabilities in MikroTik RouterOS to hijack routers with SSH exposed to the internet. The first, CVE-2026-67276, is an SSH authentication bypass that allows login without the private key by exploiting weak RSA public key validation. The second, CVE-2026-86060, is an SSH privilege escalation flaw enabling full administrative access via a crafted username. The exploit chain, dubbed 'MikroTrick' by Poland's CERT, is already being used in the wild. MikroTik has released patches in several updated RouterOS versions, and indicators of compromise include specific log entries and malicious IP addresses.

AI-extracted · verify before operational use