Do you have a MikroTik router? Update the firmware

On 3 September MikroTik released an urgent update of the RouterOS firmware and published a notice about 3 vulnerabilities, jointly named MikroTrick: CVE-2026-67276, CVE-2026-86060 and CVE-2026-67277. Through them an outsider can take control of the router.

According to CERT Polska - the national computer incident response team of Poland - the vulnerabilities have been used for attacks at least since 2 September, that is, even before the fix was released. Routers with SSH access open from the internet are at risk.

This concerns only those who have a MikroTik router. If you do not know which one you have, look at the sticker on the bottom of the case.

Which version you need

• v7 stable branch - 7.24.2 or newer
• v7 long-term branch - 7.23.4 or newer
• v6 branch - 6.49.21 or newer
• testing branch - 7.25beta3 or newer

It is better to install the latest version of your branch, not the minimum one. The number and the files are always on the official website mikrotik.com in the Download section.

How to update

1. Open the router settings via WinBox or a browser.
2. Open System - Packages and press Check For Updates.
3. Choose your branch and press Download & Install. The router will reboot by itself.
4. After the reboot, open System - Routerboard and update the bootloader with the Upgrade button, then reboot once more.

If you cannot update right now

Until you update, MikroTik and CERT Polska advise to:

• disable SSH, the web interface (the www and www-ssl services) and bandwidth-test;
• not expose the router management ports to the internet;
• access the router from outside only via VPN, for example WireGuard.

How to tell that the router has already been hacked

• System - Users has an unknown user with full rights - in the attacks a user named ops was seen;
• the Log has entries about an SSH login by the user "-2" and about a new user being added;
• after the update the router is marked as Flagged, and the log has a critical message - the new firmware checks itself for traces of hacking.

If you find any of this, consider the router hacked. Reset it to factory settings, set it up again by hand, not from an old backup, and change all passwords.

Not sure you can do it yourself - call us, we will help.

Questions - call 8-800-551-00-95 or write to abonent (at) bravotele.com.