In early September 2026, attackers began actively exploiting zero-day flaws in MikroTik RouterOS, chained as “MikroTrick”, to bypass authentication and take full control of affected devices, particularly those exposing SSH remote access. MikroTik routers are widely used across Australian businesses and service providers, so organisations should patch immediately and restrict remote access.
What happened
In early September 2026, CERT Polska warned that attackers are actively exploiting zero-day vulnerabilities in MikroTik RouterOS, the operating system that runs MikroTik’s widely used routers and network devices. The exploit chain, dubbed MikroTrick, combines multiple flaws, including issues rated at high severity, to let an unauthenticated attacker bypass authentication and escalate privileges to full control of the device. Devices that expose SSH remote access are particularly at risk.
MikroTik hardware is popular across the world, including throughout Australia, in small and mid-sized businesses, service providers and home offices, because it is capable and affordable. That popularity is exactly what makes a RouterOS flaw significant: a single vulnerability affects an enormous installed base, and attackers know it.
Why routers and edge devices are prime targets
A router sits at the boundary between your network and the internet, which makes it one of the most valuable devices an attacker can compromise. It is internet-facing by nature, it is trusted by everything behind it, and it controls the traffic flowing in and out. Take over the router, and you have a commanding position over the whole network.
Edge devices like routers, firewalls and VPN appliances have become a favourite target class for exactly this reason. They are reachable from outside without a foothold, they are often patched slowly because updating them feels disruptive, and compromising one provides deep access. The MikroTrick campaign is another entry in a long line of attacks against the network edge.
What the exploit chain allows
The MikroTrick chain is dangerous because it requires no credentials. By combining an authentication bypass with a privilege escalation, an attacker can go from no access to full control of a vulnerable device, without needing a valid login. Once in control of a router, an attacker can intercept and redirect traffic, use the device as a foothold into the network, and maintain persistent access that is hard to detect.
The dependence on exposed SSH remote access is an important detail. Devices that allow remote management over SSH from the internet are the most exposed, which points directly to two defensive levers: patching and reducing that remote exposure.
The role of exposed remote access
Many router compromises trace back to management interfaces being reachable from the internet when they do not need to be. Remote access is convenient, but every interface exposed to the internet is a door an attacker can knock on. In the case of MikroTrick, devices exposing SSH remote access are the ones at greatest risk.
Reducing that exposure is one of the most effective things you can do, both for this specific threat and as a general practice. A management interface that is not reachable from the internet cannot be attacked from the internet.
Immediate actions
If you run MikroTik devices, treat this as urgent:
- Update RouterOS to a patched version immediately, following MikroTik’s guidance
- Disable or restrict remote access, especially SSH exposure to the internet, limiting management to trusted networks
- Check devices for signs of compromise, including unexpected configuration changes, unfamiliar accounts and unusual traffic
- Review other edge devices while you are at it, since the same principles apply
- If a provider manages your network devices, confirm today that your routers are patched and hardened
Speed matters, because exploitation is already happening and routers are actively being sought out.
Why edge devices belong at the top of your patching programme
This incident reinforces a lesson that keeps repeating: internet-facing edge devices should be the highest priority in your patching and hardening. They are the most exposed and the most valuable to an attacker, so a flaw in one is far more urgent than the same severity flaw on an internal system.
Building that prioritisation into your process, patching edge devices fastest and keeping their management interfaces off the public internet, is one of the highest-value habits an organisation can adopt. Pairing it with monitoring means that even in the window before patching, exploitation attempts can be detected.
If you want help finding your exposed devices, hardening them, or watching for exploitation, see our managed detection and response services, or arrange a penetration test to confirm what an attacker can reach.
For the authoritative details, confirm against the CERT Polska advisory, MikroTik’s guidance and the CISA Known Exploited Vulnerabilities catalogue.
Frequently asked questions
What is the MikroTik RouterOS vulnerability?
It is a chain of zero-day flaws in MikroTik RouterOS, dubbed MikroTrick, being actively exploited in early September 2026. By combining an authentication bypass with a privilege escalation, it allows an unauthenticated attacker to take full control of affected devices, especially those exposing SSH remote access.
Who is affected?
Organisations running vulnerable versions of MikroTik RouterOS, particularly where SSH remote access is exposed to the internet. MikroTik devices are widely used across Australian businesses, service providers and home offices, so the affected base is large.
What should I do?
Update RouterOS to a patched version immediately, disable or restrict remote access, especially SSH exposure to the internet, and check devices for signs of compromise. If a provider manages your network, confirm today that your routers are patched and hardened.
Why are routers targeted?
Routers sit at the boundary between your network and the internet, so they are internet-facing, trusted by everything behind them, and control your traffic. They are also often patched slowly, which makes them a favourite target for attackers seeking a commanding foothold.
