Network equipment maker MikroTik has rolled out patches for six vulnerabilities in RouterOS, urging users to apply them as soon as possible, as two of them have been flagged as exploited.
The exploited flaws, dubbed MikroTrick, allow attackers to bypass authentication and take over devices, CERT Poland warns.
In a scarce advisory, MikroTik warns of the identified security defects, recommends immediate patching, and directs users to CERT Poland’s advisory for additional information.
“This is an important security update. Most configurations are not at risk,” MikroTik says. It also recommends blocking SSH access from untrusted sources, noting that compromised devices will have a “Flagged” entry in the log section.
CERT Poland, meanwhile, says it has received confirmation that two of the resolved vulnerabilities have been chained together to compromise devices.
“We now have confirmation that the combination of two of them (MikroTrick) is being exploited to take full control of devices whose SSH service is accessible from public networks. According to the information we have, updating to the latest version prevents these attacks,” CERT Poland notes.
It highlights three vulnerabilities: CVE-2026-67276 (CVSS score of 9.2), an SSH authentication bypass bug; CVE-2026-86060 (CVSS score of 9.2), an SSH session privilege manipulation issue; and CVE-2026-67277 (CVSS score of 8.8), a memory disclosure and denial-of-service weakness.
CERT Poland says hackers have been chaining the MikroTrick bugs since at least September 2, creating an account named ‘ops’. The attacks have been originating from two IP addresses, namely 82.192.72.4 and 103.102.31.18.