MikroTik SSH Auth Bypass Exploited: Patch + Assume Compromise

Mon, 07 Sep 2026 16:27:04 +0000

Engineer — Act: Patch all MikroTik devices to the latest release immediately, then audit every device for unauthorized accounts added by attackers as a persistence mechanism — patching alone will not evict existing backdoors.
SOC/IR — Act: Sweep MikroTik devices for newly created accounts and anomalous SSH sessions prior to patch date; adopt an assume-breach posture and hunt for lateral movement originating from edge devices that may already be implanted.
Leader — Act: Confirm this week whether MikroTik routers are in your environment; if so, direct teams to treat affected devices as potentially compromised, since attackers are pre-installing persistence before patches are applied — this is not a routine patch cycle.

Ssh-Auth-Bypass on CuraSec