Six Flaws, Two of Them Maximum Severity
Researchers have named the exploit chain MikroTrick, and it combines six distinct vulnerabilities discovered in MikroTik's RouterOS operating system, the firmware running on millions of routers worldwide. The two most severe, CVE-2026-67276 and CVE-2026-86060, each carry a CVSS score of 9.2. The first allows SSH user impersonation through RSA modulus forgery, and the second allows privilege escalation through specially crafted usernames sent during the authentication handshake. Chained together, the two let an attacker take complete administrative control of an exposed router without ever presenting a single valid credential.
The remaining four vulnerabilities round out a genuinely thorough chain: a kernel memory disclosure and denial of service bug scored 8.8, an unauthenticated file read flaw in the WebFig management interface scored 8.7, an SSH pre-authentication rekey bypass scored 6.9, and a TLS server impersonation flaw scored 6.3. Together they give an attacker multiple independent paths to the same outcome, which is unusually comprehensive for a single disclosed exploit chain and suggests the researchers behind it did exceptionally deep work before going public with any of it.
122,500 Devices, Concentrated in a Handful of Countries
More than 122,500 MikroTik devices have SSH management ports accessible directly on the open internet, according to internet-wide scan data collected by researchers tracking the exposure. That footprint is not evenly distributed around the globe: Brazil leads with roughly 11,300 exposed devices, followed by the United States and Indonesia tied at 7,100 each, the Czech Republic at 6,300, and Ukraine at 5,100. MikroTik routers are popular with internet service providers, small businesses, and multi-site retail chains precisely because they are inexpensive and highly flexible, which is also exactly why patching them consistently across a large fleet turns out to be genuinely hard.
Any enterprise running distributed retail locations, branch offices, or remote sites should assume some meaningful fraction of its edge network gear falls into this exact category right now. Unlike a data center server fleet with one clearly defined patch owner, edge routers spread across hundreds of locations often have no single accountable team tracking firmware currency, and vendors, franchisees, or local IT contractors may be the only people with any access at all to push an update through.
Attackers Moved Before the Patch Existed
CERT Polska discovered the underlying vulnerabilities during a routine research effort, and independent researcher Nick Pratley reverse engineered the fully exploitable chain with assistance from AI models, described publicly as GPT-5.5-cyber and GPT-5.6-sol. What makes the timeline genuinely alarming here is the sequence of events: active exploitation in the wild was first detected starting September 2, a full day before MikroTik managed to ship patches for RouterOS versions 6.49.21, 7.23.4, and 7.24.2 on September 3.
That sequencing means every exposed device sat completely undefended for at least a full day, with no patch available anywhere and no way to close the gap short of taking the management interface offline entirely and accepting the operational cost. AI-assisted vulnerability research cuts both ways in a case like this: it can help defenders find and responsibly disclose flaws faster than before, but the same tooling narrows the gap between disclosure and real-world exploitation, and here attackers appear to have moved entirely on their own timeline rather than waiting for a public proof of concept to appear.
A Distinctive Log Signature Defenders Can Hunt Right Now
The exploit chain leaves behind a genuine tell that defenders can act on immediately. Attackers create accounts using the literal username -2, which triggers a misinterpretation of file descriptor 2 inside the router's own logging system. That quirk produces distinctive log entries reading login failure for user -2 from via ssh, and separately user added by ssh:-2, both unusual enough that a simple, fast log search should surface any compromised device within minutes rather than days.
Security teams responsible for any MikroTik fleet, even indirectly through a managed service provider or a franchise network they do not operate directly, should run this exact search today regardless of current patch status, because a device compromised before patches existed does not become clean simply by applying the update after the fact. Compromised devices need to be treated as fully breached and rebuilt from a known-good image, not merely patched in place and trusted going forward.
MikroTik's Unusual Disclosure Choice
MikroTik has taken a notably conservative approach to public disclosure on this one, stating plainly in its advisory: to give time to update your systems, we are not currently publishing detailed information regarding the security advisory. That is a defensible call when a patch is brand new and exploitation is already active in the wild, since detailed technical writeups can meaningfully accelerate broader attacker adoption of an exploit chain that has not yet been widely automated into off-the-shelf tooling.
The tradeoff, of course, is that defenders get less technical detail to build detection logic around in the near term, which is exactly why the -2 username indicator matters so much right now as an interim stopgap measure. Organizations should not sit around waiting for MikroTik's eventual full writeup before acting on their own. Patch every device immediately, hunt for the log signature today, and treat continued vendor silence as a reason for more urgency internally, not less, given what is already known about active exploitation.
What This Means for the Roadmap
Bring edge network hardware fully into the same vulnerability management program that already covers servers and endpoints, complete with a named owner accountable for firmware currency at every single location, including franchise and third-party managed sites that often fall outside normal IT oversight. If nobody on your team can answer which RouterOS version is currently running at your branch offices, that gap is precisely what this incident just exposed for anyone paying attention.
For retail and multi-site operators specifically, this is a genuinely good moment to audit whether store-level network gear receives the same patch service level agreement as headquarters infrastructure does today. A compromised branch router is a foothold straight into point-of-sale systems, guest wifi, and inventory management systems alike, and MikroTrick demonstrates clearly that the window between public disclosure and active exploitation can now be measured in hours rather than the weeks security teams have historically planned around.
