1.5 Million MikroTik Devices Exposed to Critical SSH Flaw

MikroTik Devices Exposed to Critical SSH Flaw

Following the disclosure of the MikroTrick exploit chain by CERT Polska on September 5, 2026, a critical question emerged for network defenders: how many MikroTik devices are actually exposed to this vulnerability? The exploit chain, which combines CVE-2026-67276 and CVE-2026-86060, allows for privilege escalation to administrator without requiring a password or private key. The primary prerequisite for a successful attack is network reachability to the device's SSH management service from the internet. Understanding this exposure is the crucial first step in assessing the true risk to affected systems.

To quantify this exposure, data collected from ZoomEye on September 19, 2026, provides a stark picture. The analysis indicates that approximately 1.5 million MikroTik devices have their SSH port open and accessible from the public internet. This number represents a substantial attack surface for threat actors seeking to leverage the MikroTrick vulnerabilities. It's important to note that this figure represents devices with an open SSH port, not necessarily devices that are actively being targeted or are successfully compromised. However, an open port is the fundamental requirement for an exploit to even attempt to connect.

The MikroTrick vulnerability chain targets the SSH service, which is commonly used for remote administration and management of MikroTik routers. While convenient for administrators, exposing this service directly to the internet introduces significant security risks, especially when combined with known vulnerabilities. CVE-2026-67276 involves a weakness in the SSH public-key verification path, allowing for authentication bypass. This is then compounded by CVE-2026-86060, an argument delimiter injection flaw that enables session escalation to administrator privileges. The combination is potent: an attacker can bypass authentication and gain full control of the device, all without needing any credentials.

The data from ZoomEye, a popular internet-wide scanning service, scanned for devices responding on the standard SSH port (TCP 22). The results showed a global presence of these exposed devices. While the exact geographical distribution is not detailed in this specific analysis, it is reasonable to assume that regions with higher adoption of MikroTik hardware for networking infrastructure, including small to medium-sized businesses and internet service providers, would likely show a higher concentration of vulnerable devices. The sheer number, over one and a half million, underscores the widespread nature of the exposure.

It is essential to understand the limitations of this data. The ZoomEye scan identifies devices that are reachable on port 22 and respond to SSH probes. This does not confirm that the SSH service is configured with default credentials, that it is actively vulnerable to MikroTrick (though the presence of an open port is the first hurdle), or that it is even running the specific MikroTik RouterOS version affected by these CVEs. However, for any MikroTik device with an exposed SSH port, the risk is elevated. The critical nature of the MikroTrick exploit means that even a single vulnerable device can become a pivot point for broader network compromise.

For defenders, the immediate takeaway is clear: review and secure the SSH management interface. This means restricting access to trusted IP addresses, disabling SSH if it is not actively required, changing the default port, and ensuring strong authentication mechanisms are in place where remote access is necessary. For organizations using MikroTik devices, a proactive audit of all internet-facing network equipment is paramount. The number of exposed devices suggests that many administrators may not be fully aware of their network's external attack surface, or they may be prioritizing convenience over security.

The disclosure of MikroTrick and this subsequent exposure analysis should serve as a wake-up call. The combination of a widely deployed vendor, a critical vulnerability, and a significant number of internet-facing devices creates a high-priority threat landscape. The next steps for affected organizations involve not only patching RouterOS to address the vulnerabilities but also fundamentally re-evaluating their network security posture, particularly concerning remote access services.

What remains unaddressed is the long-term impact of such widespread vulnerabilities. Will this incident prompt a broader shift in how network device management services are secured by default? And how many of these exposed devices will remain unpatched, continuing to pose a risk long after the initial disclosure?