Executive Summary
In September 2026, CERT Polska identified six vulnerabilities in MikroTik RouterOS, including two critical flaws (CVE-2026-67276 and CVE-2026-86060) that can be chained to achieve full unauthenticated remote code execution and administrative takeover. This chain, dubbed 'MikroTrick,' is currently being exploited in the wild against devices with SSH services exposed to the public internet.
Attackers have been observed using this method since at least September 2, 2026, to create highly privileged 'ops' accounts and modify system configurations. MikroTik has released patches across all software branches, and a new 'Flagged' mechanism has been introduced in RouterOS to notify administrators of potential compromise during the boot process.
Organizations using MikroTik hardware must prioritize patching immediately, as comparative analysis of the updates has already allowed the research community to reconstruct functional exploits. Failure to secure these devices could result in total network compromise, credential theft, and unauthorized traffic redirection.