MikroTik Routers at Risk: Check Your RouterOS Devices Now

If you have MikroTik routers or other RouterOS devices on your network, it's worth checking them over following reports of an attack chain that can potentially give an attacker full admin access.

The attack, dubbed MikroTrick, combines two RouterOS vulnerabilities to bypass SSH authentication and gain an administrative session without needing the correct password or SSH key. The attacks have already been seen in the wild, with activity dating back to 2 September 2026.

The biggest concern is for devices where SSH is exposed to the internet. MikroTik released security fixes on 3 September 2026.

What to do now

If your school uses MikroTik equipment, this is worth putting on the IT jobs list now, rather than waiting for the next routine maintenance window.

First, check which RouterOS branch your MikroTik devices are running:

• RouterOS 6: 6.49.21 or later

• RouterOS 7 Long-term: 7.23.4 or later

• RouterOS 7 Stable: 7.24.2 or later

• RouterOS 7 Development: 7.25 beta 3 or later

If a device is running an earlier version, update it to a fixed release. Simply being on RouterOS 7 doesn't necessarily mean the device is protected.

Then work through these checks:

1. Identify every MikroTik/RouterOS device you manage, including equipment at remote schools or sites.

2. Check the RouterOS version on each device against the versions above.

3. Update vulnerable devices to a patched release.

4. Check whether SSH is accessible from the internet. If it is, restrict access to trusted management IP addresses or, preferably, use a VPN for remote management. If SSH isn't required, disable it.

5. Check the logs for -2 login attempts. This is a specific indicator associated with the MikroTrick attacks.

6. Check user accounts for an unexpected ops account, particularly one with full privileges.

7. Look for unexpected configuration changes, including scripts, scheduled tasks, tunnels, proxies, firewall rules and unfamiliar diagnostic files.

If you find something suspicious

Don't just patch the router and assume everything is OK. The vulnerability could have been exploited before you installed the update, so patching alone won't undo changes an attacker has already made.

Isolate the device where practical and preserve its logs and configuration for investigation. If compromise is confirmed, consider rebuilding the device from a known-good configuration rather than simply restoring a potentially compromised backup.

You should also change relevant passwords, SSH keys and other credentials associated with the device.

MikroTik's updated RouterOS versions can also check for certain indicators of compromise following an upgrade and flag a device if something suspicious is detected.

For schools using MikroTik equipment for routing, firewalls or other parts of the network, this is a good reminder that network infrastructure needs the same attention to security updates as your servers and PCs.

A quick version check and a look at your internet-facing management rules could be enough to identify a problem before it becomes one.

Sources: The Hacker News · MikroTik Security Advisory