MikroTrick Zero-Day Chain Exposes Edge Network Routers to Unauthenticated Takeover

CERT Poland and networking hardware vendor MikroTik have disclosed an active attack chain dubbed "MikroTrick," consisting of vulnerabilities in RouterOS that enable unauthenticated remote attackers to gain full administrative control of internet-exposed devices. The primary attack vector, tracked as CVE-2026-67276 (CVSS 9.2), involves an SSH public-key authentication bypass where RouterOS validated only the key type and modulus of an RSA public key during authentication rather than verifying the entire key structure. Threat actors chained this bypass with CVE-2026-86060 (CVSS 9.2)—a privilege-escalation flaw in how the SSH login helper processes malformed usernames—to escalate directly to root-equivalent administrative privileges. Telemetry confirmed active exploitation in the wild prior to patch availability, with attackers creating rogue administrator accounts and modifying routing rules. For network security engineers and infrastructure operators, compromised edge routers represent a severe architectural breach. RouterOS appliances frequently serve as the foundational perimeter and routing backbone for branch offices, edge colocation sites, and regional Internet service providers. Once an attacker establishes root persistence on a perimeter router, they bypass traditional endpoint detection and response (EDR) systems. Intruders can silently manipulate internal DNS resolution, capture or divert unencrypted transit traffic, establish covert outbound tunnels, and route malicious packets directly into isolated internal network segments without tripping traditional perimeter alarms. This incident illustrates an accelerating industry trend: threat actors increasingly focus their initial access campaigns against perimeter network appliances and remote-access gateways. As host-based EDR and cloud workload protection platforms have matured, boundary devices that lack native security agent support have become prime targets for stealthy intrusion. Scan data from the Shadowserver Foundation revealed over 120,000 MikroTik devices exposing SSH management interfaces directly to the public internet during the disclosure window, demonstrating that operational best practices regarding management plane isolation are still frequently ignored across distributed networks. In practice, network teams must immediately deploy patched RouterOS releases (such as 7.24.2, 7.23.4, or 6.49.21) across all deployed hardware. Because threat actors exploited these vulnerabilities as zero-days before patch release, applying the software update is only step one; organizations must conduct active compromise assessments on all internet-facing instances. SecOps teams must inspect system logs for anomalous authentication entries involving malformed usernames, verify user directories for unrecognized accounts such as "ops", and review active firewall filters. Longer term, network architectures must enforce out-of-band management by binding SSH and WebFig exclusively to dedicated management VRFs or encrypted VPN tunnels with strict IP access control lists.