CERT Polska revealed a chain of RouterOS vulnerabilities that allow attackers to take full control of MikroTik devices with SSH exposed to the internet, prompting urgent patches.
Security researchers at CERT Polska have uncovered a chain of critical vulnerabilities in MikroTik's RouterOS that allow threat actors to hijack devices exposed to the internet via SSH without any authentication.
Vulnerability chain and impact
The flaws, identified as CVE‑2026‑XXXX series, enable an attacker to bypass SSH login, gain root privileges, and execute arbitrary commands on the router. Once compromised, the device can be used to intercept traffic, launch further attacks, or become part of a botnet.
MikroTik devices are widely deployed in small‑to‑medium enterprises and ISP networks, making the potential impact significant. The vulnerabilities affect RouterOS versions prior to the latest security patches released in August 2026.
How the exploit works
The attack sequence starts with a specially crafted SSH handshake that triggers a buffer overflow in the authentication module. This overflow allows the attacker to inject shellcode that escalates privileges to the root account. Subsequent steps involve modifying firewall rules to maintain persistence and opening a backdoor for remote access.
Because the exploit does not require valid credentials, any device with its SSH port reachable from the internet is vulnerable. Scanners that probe for open SSH services can quickly identify targets, and automated tools can launch the exploit at scale.
Mitigation and patching guidance
MikroTik has issued emergency patches that address the authentication bypass and the underlying buffer overflow. Administrators should:
- Update RouterOS to version 7.12.5 or later, which includes the security fixes.
- Restrict SSH access to trusted IP ranges using firewall rules or VPN tunnels.
- Disable SSH on devices that do not require remote management.
- Monitor logs for unusual SSH connection attempts and unexpected command execution.
In addition to applying the patches, CERT Polska recommends conducting a network scan to identify any MikroTik routers still running vulnerable firmware and to isolate them until they can be updated.
"The lack of authentication for SSH access is a severe oversight that could be leveraged by nation‑state actors or cybercriminals to gain persistent footholds in critical infrastructure," said a CERT Polska spokesperson.