MikroTik published an important RouterOS security update on 3–4 September 2026 (supportsec bulletin and forum notice) with details withheld, shipping builds 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21 (7.24.2 and 7.23.4 later proved to be an incomplete fix; see the correction below).

On 5 September 2026 CERT Polska disclosed six coordinated CVEs and confirmed active exploitation.

UPDATE 23 September 2026 (The Hacker News technical analysis of CERT.PL MikroTrick): the actively exploited chain is CVE-2026-67279 (SSH state-machine / key-renegotiation skips auth success) combined with CVE-2026-86060 (login argv injection via username -2 → full-admin).

CERT.PL's 5 Sep advisory confirmed exploitation but did not name that pair; some earlier write-ups incorrectly folded separate RSA key-forge CVE-2026-67276 into the chain — 67276 remains a distinct SSH auth bypass (needs account name + public modulus; yields that account only). Highest-impact standalone pair still includes CVE-2026-67276 (CERT.PL CVSS 9.2) and CVE-2026-86060 (CVSS 9.2). CVE-2026-67277 (CVSS 8.8) is unauthenticated bandwidth-test memory disclosure/crash.

CVE-2026-67281 (CVSS 4.0 8.7 per CVE record) is unauthenticated WebFig /jsproxy file read that can disclose root-owned config stores. CERT.PL also lists CVE-2026-67278 and CVE-2026-67279 on the CVE details page.

CERT.PL says the MikroTrick combination of two SSH flaws is being used for full takeover of devices with SSH on public networks; successful attacks creating a privileged user named ops have been seen from 82.192.72.4 since at least 2 September 2026, with 103.102.31.18 used in exploit attempts. Log IoCs include login failure for user -2 via ssh and user <name> added by ssh:-2@<ip>. Fixed releases set a Flagged marker when known compromise traces are found (absence of Flagged is not clean).

Latvia's national CERT also reported increased MikroTik targeting and urged the same patched builds. Until patched: restrict SSH, WWW/WWW-SSL and bandwidth-test to trusted management nets; do not initiate TLS or built-in SSH clients from an unpatched box toward untrusted hosts. If Flagged or otherwise suspect: isolate, preserve logs/config, factory-reset and rebuild from a verified config, rotate secrets.

Primary: CERT Polska active-exploitation advisory.

UPDATE 10 September 2026: CISA added CVE-2026-86060 and CVE-2026-67277 to KEV (dateAdded 2026-09-10).

UPDATE 25 Sep 2026: CISA also added CVE-2026-67279 (SSH state-machine / behavioural-workflow bypass — the MikroTrick auth-skip half) to KEV (dateAdded 2026-09-25; federal due 28 Sep). Internet-exposed SSH / bandwidth-test paths remain the priority; patch and hunt Flagged / ops / ssh:-2 IoCs. CORRECTION (21 Oct 2026): this card earlier gave 7.24.2 and 7.23.4 as fixed builds and advised 7.23.5 on the long-term channel.

CERT Polska's advisory and the CVE-2026-67278 record say 7.24.2 and 7.23.4 contained an incomplete fix for CVE-2026-67278; the fixed releases are 7.24.3 (stable) and 7.23.6 (long-term) or later, and devices on 7.24.2 or 7.23.4 must be updated again. No source we cite mentions 7.23.5.