MikroTrick: when your edge router SSH port is the whole breach

Small businesses, WISPs, and remote offices love MikroTik for price and features. Attackers love them for the same reason when SSH faces the internet and patches lag. In early September CERT Polska disclosed multiple RouterOS flaws and confirmed active exploitation of a chain it calls MikroTrick.

What MikroTrick does

The chain combines CVE-2026-67276, an SSH authentication bypass involving incomplete RSA public key matching, with CVE-2026-86060, a privilege escalation path tied to crafted usernames. Together they can yield full administrative control without valid credentials on devices whose SSH service is reachable from untrusted networks.

Reporting from CERT Polska and follow-on analysis described exploitation in the wild before the September 5 public write-up, with patched builds landing September 3. That gap between fix availability and fleet update is where routers become persistent footholds. Indicators discussed in advisories include suspicious usernames, unexpected scripts, schedulers, proxies, and a flagged: yes marker from /system/device-mode/print after compromise.

CISA added related MikroTik CVEs to KEV alongside ScreenConnect and Artifactory entries in mid-September, with federal due dates clustered around September 13 and 14 for RouterOS items. Canadian operators should treat those dates as a nudge, not a foreign-only problem. Border gateways and branch routers get forgotten in patch programs that focus on Windows endpoints.

While you are patching edge gear

The same KEV batch included ConnectWise ScreenConnect client flaw CVE-2026-84869, rated 9.9, allowing unauthorized file transfer and execution through active remote sessions. Huntress documented worm-like abuse where rogue ScreenConnect clients infected new hosts as technicians connected. MSP tooling is a top attack vector because it is designed to cross customer boundaries quickly.

If you run ScreenConnect on-prem, move to 26.6.5, refresh host clients, and review audit logs for RunFiles or RanFiles from guest processes. If you rely on an MSP, ask for their ScreenConnect version and client refresh status in writing.

Practical steps

• Upgrade RouterOS to 7.24.2, 7.23.4, 6.49.21, or newer fixed builds per MikroTik guidance.
• Remove internet exposure on router management ports. Use VPN or out-of-band management instead.
• Inspect configs for unknown users, scripts, and tunnels after patching.
• Patch ScreenConnect clients and tighten TransferFiles permissions until updates complete.
• Include network appliances in annual assessments, not only servers and laptops.

Bottom line

Edge devices are part of your security story whether or not they run Windows. Forensic Five performs external scanning, configuration reviews, and scoped assessments for organizations that need plain-language risk documentation. From St. Albert, Alberta across Canada. We tell you what is reachable and what to fix first.