MikroTrick Hits RouterOS: Active Attacks and First Coordinated LLM-Assisted Disclosure

CERT Polska confirmed on September 5, 2026, that active attacks are underway against MikroTik routers with exposed SSH, exploiting a chain of two critical vulnerabilities that grant an unauthenticated administrative shell. The discovery, dubbed MikroTrick, includes an unprecedented methodological element: the use of advanced language models as a research tool, with mandatory human verification of working exploits.

How the MikroTrick Chain Works

The chain exploits two flaws in the RouterOS SSH service. CVE-2026-67276, with a CVSS 4.0 score of 9.2 per CERT Polska, stems from incomplete RSA public key verification: the system does not compare the entire key, allowing an attacker who knows the username and public modulus to construct a different key and bypass authentication without possessing the corresponding private key.

The second vulnerability, CVE-2026-86060 (CVSS 4.0 9.2), amplifies control: a username starting with a disallowed character alters the permission mask, elevating the session to full administrative privileges. The combination yields a root-equivalent shell on any device with TCP/22 reachable from the Internet. The NVD-published CVE-2026-86060 record, currently lacking its own assessment, classifies the weakness as CWE-88.

A third vulnerability, CVE-2026-67277 (CVSS 4.0 8.8), affects the bandwidth-test service and allows remote memory disclosure and denial of service. The other three flaws discovered by CERT Polska affect the integrated SSH client, X.509 certificate handling, and the WebFig interface.

Attack Timeline and Indicators

CERT Polska obtained confirmation that attacks using the MikroTrick chain occur "since at least 2 September." Successful accesses originate from IP address 82.192.72.4; attempts were also detected from 103.102.31.18. The distinctive compromise signature is creation of the administrative account 'ops'.

MikroTik published its security bulletin on September 3, 2026, one day after the confirmed start of exploitation. The vendor explicitly omitted technical details of the vulnerabilities in its official communication: "To give time to update your systems, we are not currently publishing detailed information." For the first time, the company sent push notifications to users of its mobile application.

"We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks" — CERT Polska

The Flagged Mechanism and Its Limits

Patched RouterOS versions introduce a mechanism called Flagged: at boot, the system scans the configuration for known signs of compromise, disables suspicious entries, logs a critical event, and sets a visible state. MikroTik and CERT Polska have emphasized, however, that absence of the marker does not rule out a prior compromise.

The mechanism is a post-intrusion response, not a preventive defense. The vendor bulletin does not specify the completeness of the scan or the catalog of integrated IoCs.

Groundbreaking Methodology: LLMs in Vulnerability Research

CERT Polska documented the use of GPT-5.5-cyber and GPT-5.6-sol models under the OpenAI GTAC program. The approach modeled SSH protocols as state machines, accelerating hypothesis exploration. Final verification, including validation of working exploits, was conducted on real systems with mandatory human intervention.

CERT Polska clarified that "The models significantly accelerated analysis and hypothesis exploration, but they did not replace these stages." The disclosure represents the first publicly coordinated vulnerability discovery with LLM support, opening debate on security guarantees, reproducibility of results, and the boundaries of responsible disclosure when research tools are proprietary.

Immediate Actions

Update immediately to versions 7.24.2, 7.23.4/7.23.5, 6.49.21, or 7.25beta3 according to the release branch in use. CERT Polska added version 7.23.5 to fix a DHCP IPv6 regression introduced in earlier patches.

Check for the Flagged marker after the post-update reboot: its activation indicates a prior compromise; its absence does not guarantee integrity.

Search for the 'ops' account in the user configuration and historical logs, along with SSH connections from IPs 82.192.72.4 and 103.102.31.18.

Assess TCP/22 exposure: entities within the NIS2 perimeter, with an obligation to notify CSIRT Italia from January 15, 2026, must weigh reporting of potentially significant incidents.

Italian Context and Risk Perimeter

No confirmed Italian victims emerge from the CERT Polska dossier. However, historical Eclypsium data reports that in December 2021 over 300,000 MikroTik devices were exposed to known flaws, with Italy among the top five most affected countries. The figure is not directly transferable to MikroTrick but indicates a consolidated attack surface within the national territory.

For ISPs, WISPs, and enterprise infrastructures, compromise of a perimeter router exposes lateral movement within the internal network, traffic interception, and attacker persistence. Criticality is highest where SSH has been exposed for remote management.

Questions and Answers

Are valid credentials required to exploit MikroTrick?
No. The chain works without prior authentication, leveraging only reachability of the SSH service on TCP/22.

Is the Flagged marker sufficient to rule out compromise?
No. CERT Polska explicitly warned that absence of the marker does not exclude an intrusion that occurred before the patch was applied.

Why is this disclosure different from previous ones?
It is the first time a national security team has documented the use of generative language models in vulnerability discovery, with coordinated disclosure and explicit human verification.

Sources

• https://www.ictsecuritymagazine.com/notizie/mikrotik-mikrotrick/
• https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
• https://cybersecuritynews.com/mikrotik-routeros-vulnerability/
• https://mikrotik.com/supportsec
• https://nvd.nist.gov/vuln/detail/CVE-2026-86060
• https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
• https://thehackernews.com/2021/12/over-300000-mikrotik-devices-found.html
• https://cert.gov.lv/lv/2026/09/uzbruceji-pastiprinati-censas-kompromitet-mikrotik-marsrutetajus

Information verified against cited sources and current as of publication.

Sources