Sun, 06 Sep 2026
← BackAttackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska's attack warning, published on September 5. Successful attacks date to at least September 2. The Hacker News’s September 6 review of the warning found no victim count or attacker identity. MikroTik's security update lists fixed RouterOS releases.
CERT says the fixes prevent the observed attacks and recommends immediate installation, followed by a check for unauthorized configuration changes. According to the vendor's default firewall explanation, home MikroTik devices block public access to management ports while their default firewall rules remain intact. The Hacker News checked CERT's affected RouterOS versions against MikroTik's listed fixes on September 6. Use the official RouterOS downloads for your update.
The 7.23.5 regression fix addresses an IPv6 DHCP (Dynamic Host Configuration Protocol) problem introduced in 7.23.4 while retaining the security update. Until the update can be installed, CERT recommends turning off exposed services or restricting access to trusted management networks, particularly for SSH, WWW/WWW-SSL, and bandwidth-test. It also advises against initiating Transport Layer Security (TLS) connections or using RouterOS's built-in SSH clients from an unpatched device. These temporary restrictions cover the broader set of vulnerabilities...
Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska's attack warning, published on September 5. Successful attacks date to at least September 2. The Hacker News’s September 6 review of the warning found no victim count or attacker identity. MikroTik's security update lists fixed RouterOS releases.
CERT says the fixes prevent the observed attacks and recommends immediate installation, followed by a check for unauthorized configuration changes. According to the vendor's default firewall explanation, home MikroTik devices block public access to management ports while their default firewall rules remain intact. The Hacker News checked CERT's affected RouterOS versions against MikroTik's listed fixes on September 6. Use the official RouterOS downloads for your update.
The 7.23.5 regression fix addresses an IPv6 DHCP (Dynamic Host Configuration Protocol) problem introduced in 7.23.4 while retaining the security update. Until the update can be installed, CERT recommends turning off exposed services or restricting access to trusted management networks, particularly for SSH, WWW/WWW-SSL, and bandwidth-test. It also advises against initiating Transport Layer Security (TLS) connections or using RouterOS's built-in SSH clients from an unpatched device. These temporary restrictions cover the broader set of vulnerabilities and do not replace the update.
MikroTik's Flagged status guidance states that RouterOS flags a device when startup checks detect suspicious configuration. RouterOS disables those entries and restricts certain functions. After updating, check the logs and run /system/device-mode/print to inspect that status. Even without a warning, inspect the configuration for unknown users, scripts, and other unrecognized changes.
CERT also points to unexpected highly privileged ops accounts and account-creation logs containing ssh:-2@ as signs to investigate. If the warning, logs, or configuration suggest compromise, CERT recommends these recovery steps. Do not clear Flagged before preserving the evidence and completing the analysis. CERT calls the reported 2-flaw combination MikroTrick.
The Hacker News compared CERT's warning and vulnerability disclosure on September 6. Neither explicitly identifies which 2 vulnerabilities form the observed chain or explains how they combine to give administrative control. The 7.25beta3 release notes have a September 2 changelog date, while the beta and other initial fixes were announced on September 3. The Hacker News compared these release announcements with CERT’s attack timeline on September 6.
Those dates do not establish whether a fix was publicly available before the attacks, so zero-day status remains unverified. The Hacker News has contacted CERT Polska and MikroTik for comment. See how to test new CVEs against your environment, confirm what attackers can actually exploit, and fix the exposures that pose the greatest risk. Learn how to identify exploitable risk faster, prioritize what matters most, and reduce exposure before AI-powered attacks accelerate the threat.
Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free.