Key takeaways
CERT Polska has disclosed six MikroTik RouterOS vulnerabilities, two of which chain together as “MikroTrick” to let an unauthenticated attacker take full administrative control of a router over SSH, with exploitation under way since around 2 September 2026, a day before patches existed.
Any device with SSH, WWW or WebFig reachable from the internet is at risk, and the fix is to update to RouterOS 7.24.2, 7.23.4 or 6.49.21 (or later) and restrict management access to a VPN or trusted IP.
Devices that were ever internet-exposed should be checked for signs of compromise, not just patched.
A critical RouterOS flaw, live exploitation since 2 September 2026, and what secure network design should have prevented it.
Poland’s national CSIRT, CERT Polska, found and coordinated the disclosure of six RouterOS
vulnerabilities with MikroTik. The two most serious, CVE-2026-67276 and CVE-2026-86060, can be
chained into what CERT Polska calls MikroTrick. Together they let an unauthenticated attacker open an
SSH session and escalate it to full administrative control, provided SSH is reachable from the internet. No
password guessing and no leaked key are required.
MikroTik pushed patched builds on 3 September but, unusually, did not publish technical details at the
time, giving operators a short window to update before the mechanics became public on 5 September.
Independent researchers have since reported well over 100,000 RouterOS devices with SSH exposed to
the internet, and CERT Polska has stated that attacks were already under way before the patch existed.
Why This Matters Beyond MikroTik
It is tempting to read this as a MikroTik problem. It is really a management exposure problem, and
MikroTik is simply this month’s example. Any router, firewall or CCTV recorder with its SSH, web GUI or
diagnostic port reachable from the public internet is one undisclosed flaw away from the same outcome.
Once an attacker holds admin rights on the device sitting at the edge of a CCTV system, a solar site or a
critical infrastructure link, they can pivot into whatever sits behind it.
This is exactly the scenario our Cyber Notes flag throughout our own configuration guides: a management
interface exposed to the internet is a standing risk, not a convenience, regardless of which vendor’s box it
happens to be running on.
How We Design Around This
Netcelero exists to give sites a fixed, reachable identity over 4G, 5G, Starlink or fibre without putting a
management interface on the public internet. On an i-ctrl, SSH and the web GUI are never exposed to a
public address. Support access runs over a management VPN from the device back into our own core
network in Dublin and Amsterdam, with individual, MFA-protected accounts on our side. The only interface
reachable from the customer’s LAN is a read-only diagnostics page, and even that can be disabled on
request.
That architecture will not stop every future vulnerability. It does mean that a flaw in an internet-facing SSH
or web service on the router is not, by itself, a route into a Netcelero-connected site, because there is no
such service to reach.
What To Do Now
- Update any MikroTik device to RouterOS 7.24.2, 7.23.4 or 6.49.21, or a later build, without delay.
- Check whether SSH, WWW or WebFig are reachable from the internet on any router, not only MikroTikones, and restrict them to a management IP or VPN only.
- Treat any device that has had SSH exposed to the internet as potentially compromised until you have checked it, not just patched it. Look for unfamiliar users, changed policy masks or unexpected configuration.
- Keep an eye on connection and login anomalies at the network level. A device that starts talking to an unfamiliar destination is often the first visible sign, well before anything else looks wrong.
Cyber Notes
Patching closes the door MikroTik left open. It does not tell you whether someone already walked through it. If
SSH or WebFig on any of your routers has ever been reachable from the internet, that device is worth a
proper look, not just an update.
Want a second set of eyes on your network exposure?
Our team works daily with CCTV, ARC and critical infrastructure networks across Ireland, the UK and
Northern Europe, and we are glad to help you check whether your management interfaces are exposed and
what a more resilient setup could look like. Get in touch with us at today.
Sources: CERT Polska security advisory (cert.pl), MikroTik September 2026 security notice (mikrotik.com),
and independent security reporting.
