Attackers are exploiting newly disclosed MikroTik RouterOS vulnerabilities to take control of routers with SSH exposed to the internet, according to BleepingComputer. The report says Poland’s CERT agency has confirmed active exploitation of a two-bug chain it calls “MikroTrick.” The first flaw, CVE-2026-67276, is described as an SSH authentication bypass in RouterOS. BleepingComputer reports that the issue stems from incomplete validation of RSA public keys: an attacker who knows a username and the public modulus of that user’s key can craft another key and log in without possessing the legitimate private key. The second flaw, CVE-2026-86060, is an SSH privilege-escalation issue. According to the report, a specially crafted username can be used to manipulate the SSH session and obtain full administrative privileges. In combination, the two bugs can move an attacker from unauthorized access into full router control when the SSH service is reachable from public networks. BleepingComputer says both vulnerabilities were discovered by Poland’s CERT with the help of GPT-5.5-cyber and GPT-5.6-sol and received critical severity ratings. The agency warned that it has observed attacks against internet-accessible RouterOS devices in recent days and obtained confirmation that the exploit chain is being used to take over exposed devices. The CERT also highlighted a third RouterOS vulnerability, CVE-2026-67277, affecting the bandwidth-test service. BleepingComputer reports that this flaw can allow unauthenticated attackers to leak kernel memory or remotely crash or restart a router. MikroTik has released fixes in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, all released on September 3, according to BleepingComputer. The report says Poland’s CERT validated the fixes. MikroTik’s advisory says not all configurations are affected, but the vendor did not publish full configuration details to give users time to apply updates. The updates also add a compromise-detection mechanism that runs at startup, according to the report. It looks for known signs of unauthorized configuration changes, disables malicious entries, and logs a critical warning. Poland’s CERT cautions, however, that the absence of such a marker should not be treated as proof that a router was never compromised. For suspected compromises, BleepingComputer says Poland’s CERT recommends isolating the router, preserving logs and configuration, factory-resetting the device, rebuilding it from a trusted configuration, and rotating passwords, keys, and other secrets. For organizations that cannot patch immediately, the reported mitigations include restricting or disabling externally reachable SSH, WWW/WWW-SSL, and bandwidth-test services, and avoiding built-in SSH clients and outbound TLS connections over untrusted networks. The exposure base is material. BleepingComputer cites ShadowServer Foundation data showing 122,500 MikroTik devices with an exposed SSH interface as of September 5, while noting that the exact number actually vulnerable to the exploit chain was not determined. Who benefits: Defenders benefit from a clear patch path and from MikroTik’s added compromise-detection mechanism. Organizations that already restrict management services away from the public internet are less exposed to the reported SSH attack chain. Who's exposed: Owners of MikroTik RouterOS devices with SSH or related management services reachable from public networks are most exposed, especially if they have not applied the September 3 updates. The exact vulnerable population is not known from the provided reporting.