Critical MikroTik SSH Authentication Bypass Under Active Exploitation — Patch Immediately

MikroTik released a patch late last week for a critical vulnerability that allows attackers to bypass SSH authentication on affected devices. According to the SANS Internet Storm Center, the flaw is already being actively exploited in the wild.

What Happened

Per the ISC advisory, the vulnerability enables an SSH authentication bypass on MikroTik devices. Exploitation is already occurring, and attackers observed exploiting the flaw have been adding new accounts to compromised devices — a persistence mechanism intended to retain access even after the device is patched.

Why It Matters

MikroTik RouterOS devices are widely deployed as edge routers, VPN endpoints, and network infrastructure for organizations of all sizes, as well as by ISPs. An authentication bypass on the SSH management interface is a high-severity issue on its own, but the reported post-exploitation behavior — planting new accounts — means patching alone will not remediate an already-compromised device. ISC's guidance is blunt: at this point, assume compromise if the device was internet-exposed and unpatched.

What Defenders Should Do Now

• Apply MikroTik's patch immediately on all affected devices.
• Do not treat patching as sufficient remediation — audit the local user/account list on every MikroTik device for unfamiliar or unauthorized accounts created before or around the patch date.
• Review SSH authentication logs and RouterOS user management logs for unexpected account creation events, especially any that occurred prior to patching.
• Restrict SSH management access to trusted management networks or VPNs rather than exposing it directly to the internet, and consider disabling SSH management entirely where not required.
• Rotate credentials and review firewall/NAT rules for unauthorized changes, since attackers with account-level persistence may also modify device configuration.
• Treat any device that was internet-reachable and unpatched during the exploitation window as potentially compromised until verified otherwise.

This is a developing story and details on the specific vulnerability, affected RouterOS versions, and exploitation scope are still emerging. For the latest information, see the original SANS ISC diary: https://isc.sans.edu/diary/rss/33314.