NETWORKING · September 28, 2026
MikroTik router flaw added to CISA’s exploited list: why exposed router management is a business risk
By CG Networks Team · Published
At a glance
On September 25, 2026, CISA added CVE-2026-67279, a flaw in the SSH server of MikroTik RouterOS, to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation. According to CERT Polska, which researched it, attackers chain it with a second RouterOS bug to get full administrative control of a router without a password or SSH key. MikroTik published fixed versions on September 3. Why it matters: A router whose management interface can be reached from the internet can be taken over outright, so update RouterOS and close remote management access now.
Many businesses don’t use MikroTik. The lesson still applies to any brand: the router that runs your internet connection is a high-value target, and remote management access you opened for convenience is often how attackers get in.
What happened
CERT Polska calls the attack chain “MikroTrick.” The first flaw, CVE-2026-67279, is a mistake in how RouterOS handles an SSH key renegotiation (a “rekey”) during login. On vulnerable versions, the router moved on to accepting commands even though the user had never authenticated. The second flaw, CVE-2026-86060, let a specially crafted username change the privileges of that session. Together they gave an unauthenticated attacker a full administrator console. CISA added CVE-2026-86060 to the KEV catalog on September 10.
In its September 5 warning, CERT Polska said it had confirmed attackers using the chain against RouterOS devices with SSH reachable from public networks, and that successful attacks had been occurring since at least September 2. One reported sign of compromise was a new highly privileged user account named “ops.” In a technical write-up published September 22, CERT Polska explained how it identified the chain by comparing patched and unpatched code and reading logs that administrators had posted online.
MikroTik’s fixes are in RouterOS 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. MikroTik says its default configuration blocks SSH from the internet, so the main risk is to devices where someone opened that access manually. Patched versions also check for known signs of tampering at startup and mark a device as “Flagged” in the log if they find any. CERT Polska cautions that a missing flag doesn’t prove a device is clean.
What this means for Miami businesses
Routers are often installed once and then forgotten. In many small offices, retail locations and shared buildings, the person who set up the router, whether a previous IT contractor, a property manager or the internet provider, isn’t the person responsible for it today. Remote management may have been opened years ago so someone could fix problems without driving to the site, and nobody closed it afterward.
That is exactly the setup this campaign targets. An attacker who controls your router can watch or redirect traffic, add hidden accounts, create tunnels into your network and survive a simple reboot. Because exploitation began before the patch was widely known, updating alone isn’t enough. The device also needs to be checked for changes made before the update.
Practical next steps
- Find out what your router is. Write down the make, model, firmware version and who has admin access. If it’s a MikroTik, confirm it runs one of the fixed RouterOS versions or later.
- Close management access from the internet. SSH, web and other admin interfaces shouldn’t be reachable from the public internet. Where remote administration is needed, restrict it to trusted addresses or put it behind a VPN.
- Check for tampering after updating. Look for unknown users (including “ops”), scripts, scheduled tasks, proxies and tunnels, and review the log for a Flagged warning.
- If you find signs of compromise, rebuild, don’t just patch. CERT Polska recommends isolating the device, saving its logs and configuration, resetting it to factory settings, rebuilding from a trusted configuration and changing all passwords and keys. Don’t restore a full backup taken from a device that may be compromised.
- Put network gear on a patch schedule. Firewalls, routers and switches need the same regular updates as laptops.
How CG Networks can help
CG Networks designs, secures and supports business networks for organizations across Miami and South Florida. Whatever brand of router you run, we can help you identify your network equipment, check firmware against current advisories, close unnecessary remote access and set up a routine for keeping it updated. If you aren’t sure whether this week’s advisory affects your office, contact us and we’ll help you find out.
Sources
- CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Sept. 25, 2026)
- CERT Polska — Critical vulnerabilities in MikroTik RouterOS are being actively exploited (Sept. 5, 2026)
- CERT Polska — MikroTrick: technical analysis and disclosure process (Sept. 22, 2026)
- MikroTik — September 2026 vulnerability security bulletin
- NIST NVD — CVE-2026-67279
- CISA — Known Exploited Vulnerabilities Catalog
Details reflect the linked sources as of September 28, 2026. Vendor advisories change; confirm affected versions and fixes with the vendor before acting.