tag: Mikrotik · 6 items
- Engineer — Act: Pre-authentication RCE on a widely deployed network OS with a CISA advisory is high-priority regardless of missing EPSS/PoC signals; patch MikroTik RouterOS to the latest available version immediately, and until patched, restrict or disable remote management interfaces (Winbox, SSH, web) to trusted networks only.
- SOC/IR — Plan: The summary provides no IOCs, TTPs, or ATT&CK mappings to hunt on today; queue a detection build for anomalous management-plane traffic to MikroTik devices and prepare an assume-breach sweep playbook for network infrastructure in case active exploitation evidence surfaces.
- Leader — Plan: Confirm whether MikroTik RouterOS appears in your network or vendor inventory and direct engineering to treat patching as this-sprint priority; CISA advisories on critical network-device flaws frequently precede board-level questions when exploitation becomes public.
- Engineer — Act: SharePoint (CVE-2026-65660, CVSS 8.8) is CISA KEV-listed, has a public PoC, and is seeing active exploitation — patch immediately per Microsoft’s advisory. Also audit MikroTik RouterOS firmware versions and apply vendor patches for the co-listed flaw.
- SOC/IR — Act: Active exploitation of both SharePoint and MikroTik RouterOS means assume-breach posture for those surfaces: hunt SharePoint access logs for code-injection patterns and sweep network edge devices running RouterOS for anomalous outbound connections or config changes since the KEV listing date.
- Leader — Plan: Confirm whether SharePoint and MikroTik RouterOS appear in your asset inventory and verify engineering teams are tracking CISA BOD remediation timelines; no board-level communication required unless your sector has seen confirmed targeting or you are under federal compliance obligations.
- Signals: CVE-2026-65660 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: CVE-2026-86060 is CISA KEV listed with a public PoC, and the chain enables unauthenticated admin takeover of internet-exposed RouterOS devices. Immediately patch RouterOS to the vendor-fixed version, disable SSH exposure on WAN interfaces, and audit firewall rules to confirm MikroTik management ports are not reachable from the internet.
- SOC/IR — Act: CVE-2026-86060 is KEV listed and attack logs confirm real-world exploitation; hunt for anomalous SSH sessions or new admin accounts on any MikroTik devices in the estate since the earliest known attack date, and add detections for unauthenticated admin-session establishment on edge routers.
- Leader — Skip
- Signals: CVE-2026-67279 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub · CVE-2026-86060 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: Patch all MikroTik devices to the latest release immediately, then audit every device for unauthorized accounts added by attackers as a persistence mechanism — patching alone will not evict existing backdoors.
- SOC/IR — Act: Sweep MikroTik devices for newly created accounts and anomalous SSH sessions prior to patch date; adopt an assume-breach posture and hunt for lateral movement originating from edge devices that may already be implanted.
- Leader — Act: Confirm this week whether MikroTik routers are in your environment; if so, direct teams to treat affected devices as potentially compromised, since attackers are pre-installing persistence before patches are applied — this is not a routine patch cycle.
- Engineer — Act: Active exploitation of a chained vulnerability pair targeting MikroTik RouterOS devices with SSH exposed to the internet; patch RouterOS to the latest stable release immediately and restrict SSH access to trusted management IPs via firewall rules.
- SOC/IR — Act: Router hijacking via exposed SSH is an assume-breach scenario for any MikroTik devices in the estate; sweep SSH auth logs on edge devices for anomalous logins, and hunt for lateral movement originating from RouterOS management interfaces since disclosure.
- Leader — Plan: Actively exploited edge-device flaws can expose the entire network perimeter; confirm whether MikroTik equipment is present in the environment and verify the engineering team has a patch plan for exposed devices this week.
- Engineer — Act: Active exploitation of internet-exposed MikroTik SSH granting full admin access is confirmed by CERT Polska; immediately audit all MikroTik devices for internet-reachable SSH, restrict SSH to management-only networks, and review recent device configurations for unauthorized changes since September 2.
- SOC/IR — Act: Edge device full-takeover with confirmed active exploitation since at least September 2 is an assume-breach signal; sweep MikroTik routers for unauthorized admin sessions and configuration changes, and check for anomalous outbound traffic from these devices as a lateral-movement indicator.
- Leader — Plan: MikroTik is common in SMB and branch-office environments; direct the security team to inventory internet-facing MikroTik SSH exposure and confirm whether any devices were reachable since September 2 — not yet a systemic board-level event but escalate if exposure is confirmed.