Attackers chain two MikroTik RouterOS flaws to seize internet-exposed routers

Hackers are exploiting a chain of two recently disclosed MikroTik RouterOS vulnerabilities to take control of routers whose SSH service is reachable from the internet, according to BleepingComputer. The first flaw, CVE-2026-67276, is an SSH authentication bypass caused by incomplete validation of RSA public keys. An attacker who knows a username and the public modulus of that user's key can craft a different key and log in without the legitimate private key. The second, CVE-2026-86060, is an SSH privilege escalation bug stemming from improper handling of specially crafted usernames. A crafted username lets an attacker manipulate the session to obtain full administrative privileges. Both issues were discovered by Poland's CERT agency with the help of GPT-5.5-cyber and GPT-5.6-sol and carry a critical severity rating. The agency named the exploit chain "MikroTrick" and warned it is being used in the wild. "In recent days we have been observing attacks against RouterOS devices accessible from the internet," the agency said, adding that it has confirmed attackers are combining the two bugs to take full control of devices with exposed SSH. The affected population is any RouterOS device that exposes SSH publicly. Operators should restrict SSH exposure and apply MikroTik's fixes. The report is also a notable example of AI-assisted vulnerability discovery feeding directly into a national CERT disclosure.