MikroTik MikroTrick: update RouterOS now if you run one at home

If you run a MikroTik router at home and you ever opened SSH (or other management access) to the wider internet, treat this as a same-day update. MikroTik published a September 2026 vulnerability bulletin on September 3, 2026. CERT Polska followed on September 5, 2026 with an advisory that the MikroTrick chain is being actively exploited against RouterOS devices whose SSH service is reachable from public networks.

You do not need a lab to care about this. You need a working home router that still belongs to you.

What MikroTrick is (plain English)

CERT Polska named a two-bug chain MikroTrick. The public CVE pair for that chain is CVE-2026-67276 and CVE-2026-86060. Together, they can let an attacker take full control of a vulnerable RouterOS device when remote SSH access is available. MikroTik’s bulletin also references a related issue tracked as CVE-2026-67277. For the official wording, use MikroTik’s bulletin and CERT Polska’s English advisory.

MikroTik says most default setups are not immediately at risk because the default configuration blocks SSH from the internet. The higher-risk group is people who manually opened management ports (especially SSH) so they could log in from outside the house. If that sounds like you, update first, then tighten access.

I am not going to walk through how the bugs work. Patching and checking your own box is the job.

Fixed RouterOS builds

Install one of the fixed releases named by MikroTik and CERT Polska:

• 7.25 beta 3 (also written 7.25beta3)
• 7.24.2
• 7.23.4
• 6.49.21

Pick the channel that matches how you already update this router. Home users on the long-term or stable track usually want 7.24.2, 7.23.4, or 6.49.21, not a beta, unless you already run betas on purpose.

Update it from WinBox, WebFig, or the phone app

1. Connect the way you normally manage the router (WinBox on a computer, WebFig in a browser, or the MikroTik mobile app). Prefer doing this from your home network, not from a random coffee-shop Wi-Fi session into an exposed admin port.
2. Open Check for Updates (MikroTik’s bulletin points you there). Download and install a fixed build from the list above.
3. Reboot if the update asks for it, then log back in and confirm the running version is actually one of the fixed builds. Do not stop at “download finished.”
4. If the phone app offers a push or update prompt, use it. CERT Polska notes MikroTik also sent push notifications to phones with the MikroTik app installed when this fix shipped.

If Check for Updates will not offer a fixed build, check which RouterOS package channel the device is on, then switch only as far as you need to reach a named fixed version. When in doubt, stay on the same major line you already trust and take the matching patch release.

After the update: Flagged status, logs, and stranger accounts

Updating stops the known attack path. It does not magically prove nobody already got in while SSH was open.

Do this on your own router after the new build is running:

1. Check Flagged status and the log. MikroTik says RouterOS can mark a compromised device as Flagged and write a critical entry in Log. If you see that, follow MikroTik’s Flagged documentation linked from the bulletin. CERT Polska is blunt: treat Flagged as a sign of possible takeover, not a curiosity.
2. Look for unknown users. CERT Polska calls out a highly privileged user named ops as one observed indicator. If you see an account you did not create, stop treating the box as healthy.
3. Scan scripts and schedulers. Look for scripts, scheduler jobs, proxy settings, or tunnels you do not recognize. Delete nothing until you have a screenshot or export of what you found, then rebuild from a clean config if compromise looks real.
4. Close management from the internet. MikroTik’s guidance is clear: do not leave SSH open to untrusted networks. Prefer a strong VPN such as WireGuard for remote access, and keep management ports off the public internet.

Absence of Flagged is not a clean bill of health. Still look at users, scripts, and schedulers after you patch.

Who should move fastest

• You manually forwarded SSH (or other admin ports) to the router: update today, then lock that exposure down.
• Default home setup, management only on the LAN: still update. MikroTik recommends it for everyone, even when the default firewall blocked the internet path.
• You are not sure whether SSH was ever opened: check the firewall and service settings after you update. If you find a hole you forgot about, close it.

Do not do this

• Do not leave SSH (or WinBox/WebFig) reachable from the whole internet “just for convenience.”
• Do not ignore a Flagged marker or a mystery ops user because the Wi-Fi still works.
• Do not restore a full config backup from a possibly compromised router without reviewing it. CERT Polska warns against blindly restoring a dirty backup.
• Do not hunt for exploit details or “test scripts” from random forums. You need the vendor fix and a clean config check, not a DIY attack kit.

Bottom line

MikroTrick (CVE-2026-67276 plus CVE-2026-86060) is a RouterOS chain that attackers are already using when SSH is reachable from the internet. Update your home MikroTik to 7.25 beta 3, 7.24.2, 7.23.4, or 6.49.21, confirm the version, check Flagged status and logs, look for unknown users (including ops), scripts, and schedulers, then keep management off the public internet. Official details live in MikroTik’s September 2026 bulletin and CERT Polska’s September 5 advisory.