Filed under: Cybersecurity · Network Security · September 2026
What happened
Attackers are chaining two flaws in MikroTik’s RouterOS software to take full admin control of routers over SSH, the remote-management service, without needing a password (CVE-2026-67279 and CVE-2026-86060). Poland’s national CERT found attack logs going back to September 2, the day before MikroTik released fixes. Researchers first named the wrong CVE for half of the chain and corrected it on September 22. CISA added the corrected flaw to its list of actively exploited vulnerabilities on September 25.
Why it matters to your business
MikroTik routers are inexpensive and common in small offices, often put in by a local ISP or a past IT contractor and then left alone. Every byte of internet traffic your office sends or receives passes through that box, so whoever controls it can redirect traffic, capture logins, or use it as a way into your network. Patching alone may not be enough: investigators found attackers adding their own admin accounts and scripts that rebuild a backdoor every day, and those stay in place after the update.
What to do this week
1. Find out whether you have MikroTik gear. Check the label on your router, or ask your ISP or IT provider. 2. Update RouterOS to 7.24.2 (stable), 7.23.4 (long-term), or 6.49.21 (older long-term branch) or later. In WinBox or WebFig, go to System > Packages > Check For Updates, install, then reboot. 3. Check for a break-in. Under System > Users, look for accounts you don’t recognize, especially one named “ops”. Under System > Scripts and System > Scheduler, look for anything you didn’t set up. In the Log, look for SSH logins from odd usernames like “-2”. 4. Lock down remote management. Under IP > Services, turn off SSH, www, and www-ssl if you don’t need them, or use the “Available From” field so only your office or IT provider’s addresses can reach them. Also turn off the bandwidth-test server (Tools > BTest Server). 5. If you find anything suspicious, change every password stored on the router (admin, VPN, Wi-Fi). The safest fix is to reset the router to factory settings and set it up again from scratch.
The bigger picture
Routers are the most forgotten computers in most small offices. They run 24/7, sit right on the internet, and almost never get updated. Attackers know this, and this time they were in before a fix even existed, which is why regular checks matter as much as the patch itself. → Proactive vs. Reactive IT Management: Lessons from Healthcare for SMBs
Not sure what’s running your office network, or when it was last updated? Book a free consult → https://micro1tech.com/contact/