MikroTrick attacks target exposed RouterOS management
CERT Polska and CERT.LV report MikroTrick attacks on RouterOS devices with publicly reachable SSH. MikroTik urges updates and configuration checks, even without a warning flag. Sources: CERT Polska, CERT.LV, MikroTik.
CERT Polska and CERT.LV report exploitation of the MikroTrick vulnerability combination against MikroTik RouterOS devices with SSH management exposed to public networks. The two response teams describe unauthenticated device takeover. MikroTik has published fixes and, alongside CERT Polska, advises updating and inspecting device configurations. The vendor recommends restricting SSH access to trusted networks. Its advice includes checking unfamiliar users and scripts even if the device does not show a Flagged warning. CERT Polska: https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ CERT.LV: https://www.cert.gov.lv/lv/2026/09/papildinats-uzbruceji-pastiprinati-censas-kompromitet-mikrotik-marsrutetajus MikroTik: https://mikrotik.com/supportsec/september-2026-vulnerability/