Critical MikroTik Vulnerability Allows SSH Authentication Bypass, Exploited in the Wild

MikroTik has issued an urgent patch for a critical security vulnerability that allows attackers to bypass SSH authentication, a flaw that is already being actively exploited in the wild. The vulnerability, identified as CVE-2026-3077, affects MikroTik RouterOS and the SwOS operating system, and could allow unauthenticated attackers to gain unauthorized access to network devices.

Attackers exploiting this vulnerability are reportedly adding new user accounts to compromised MikroTik devices. This tactic is commonly used to ensure persistent access even if the initial exploit is detected or the device is rebooted. The addition of rogue accounts can be difficult to detect and can serve as a backdoor for future malicious activities, including further network reconnaissance or lateral movement.

The vulnerability stems from an improper handling of authentication credentials within the SSH service. While specific technical details are limited, it is understood that the flaw allows an attacker to circumvent the normal authentication process, effectively logging in without valid credentials. This type of vulnerability is particularly dangerous as it requires no prior authentication, making it an easy target for automated scanning and exploitation.

MikroTik has released updated versions of RouterOS and SwOS that address this critical flaw. The company strongly advises all users to update their devices immediately to the latest available versions. The patch not only fixes the vulnerability but also includes a mechanism to detect and flag potential compromises that may have occurred prior to the update.

Beyond patching, MikroTik has also provided guidance on how to check for signs of compromise. Users are encouraged to review their device configurations for any unfamiliar user accounts or suspicious network activity. The company's advisory emphasizes the importance of maintaining up-to-date firmware and implementing strong security practices, such as disabling unnecessary services and using strong, unique passwords.

The exploitation of this vulnerability highlights the ongoing threat to network infrastructure devices. Routers and other network appliances often sit at critical junctures within an organization's network, making them prime targets for attackers seeking to gain a foothold or disrupt operations. The ease with which this vulnerability can be exploited, combined with its active exploitation in the wild, underscores the need for prompt patching and vigilant monitoring.

This incident serves as a stark reminder for organizations to prioritize the security of their network edge devices. Regular vulnerability scanning, timely patching, and robust security configurations are essential to defend against such threats. The addition of persistence mechanisms by attackers further emphasizes the need for comprehensive incident response plans that include thorough forensic analysis to detect and remove any unauthorized access.

This update expands on the previously reported critical vulnerability in MikroTik routers by detailing a chain of six flaws, collectively named MikroTrick. CERT Poland confirms that two of these vulnerabilities, CVE-2026-67276 and CVE-2026-86060, are being actively exploited in the wild to achieve full device control via SSH. The advisory also lists additional vulnerabilities, including CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, and CVE-2026-67281, with recommended patching to versions 7.25beta3, 7.24.2, 7.23.4, or 6.49.21.

This new report from Bishop Fox details the specific "MikroTrick" attack chain that combines CVE-2026-67279 and CVE-2026-86060 to achieve full administrative control of MikroTik RouterOS 7.x devices without authentication. The researchers found evidence of exploitation in the wild predating the public disclosure, and highlight that patching alone does not remove existing persistence mechanisms, such as hidden accounts or scheduled tasks that recreate privileged access.