Polish CERT has publicly disclosed three vulnerabilities affecting MikroTik routers, two of which are already being exploited in the wild. The issues were found in devices that allow SSH access from the internet, with more than 122,000 potentially vulnerable routers observed online as of September 5.
The two most severe flaws both carry a CVSS score of 9.2. CVE-2026-67276 permits an attacker who knows a valid username and the public-key module to bypass SSH authentication entirely. CVE-2026-86060 enables privilege escalation when a username containing malformed characters is supplied. When chained, the pair allows complete compromise of the router.
A third vulnerability, CVE-2026-67277 (CVSS 8.8), exists in the internet-connection speed-test service and can be abused to trigger a denial-of-service condition. The flaws were initially identified by automated analysis using OpenAI models GPT 5.5 Cyber and GPT 5.6 Sol, with subsequent manual confirmation by researchers.
Exploitation activity began at the same time MikroTik released patches. Updated firmware is available in RouterOS versions 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. The vendor also enhanced built-in detection of prior compromise; affected devices now produce characteristic log entries such as “login failure for user -2 from ‘ip’ via ssh” and “user ‘name’ added by ssh:-2@‘ip’”.
Additional security updates released last week include a critical fix for a VoIP stack flaw in WeChat that enabled the creation of the self-propagating WeWorm, a record 972-patch Microsoft release containing two zero-days, 230 patches from Google that addressed an actively exploited Chrome vulnerability, and fixes for path-traversal issues in GitLab as well as Adobe Commerce and Magento.
