In short: On September 26, 2026, Russia's Main Radio Frequency Center (GRFC), part of the telecom regulator Roskomnadzor, ordered ISPs to audit MikroTik routers on their own networks and at subscribers' premises over critical RouterOS vulnerabilities. Analyst firm Fplus estimates roughly 100,000 such devices are in use across Russia. The flaws — CVE-2026-67276, CVE-2026-67277, CVE-2026-67278 and CVE-2026-86060 — allow SSH authentication bypass, privilege escalation, and unauthenticated remote reboots. ISPs are told to notify owners of vulnerable devices; if no update is applied within roughly a week, providers may restrict traffic through specific ports.
What happened
Russia's Main Radio Frequency Center instructed telecom operators to take security measures against critical vulnerabilities in RouterOS, the operating system made by Latvian router manufacturer MikroTik. The directive covers both operators' own network infrastructure and equipment installed at subscribers' homes and small offices. Analyst firm Fplus estimates around 100,000 MikroTik devices are currently in use in Russia and fall within the risk pool.
This is a separate incident from the earlier September "silent patch" story involving a hidden "ops" backdoor account we covered previously — that case involved an undisclosed flaw flagged by Latvia's CERT.LV, while this one centers on specific CVEs identified by Poland's CERT Polska and a direct regulatory order to Russian ISPs.
What vulnerabilities were found
CERT Polska researchers described several flaws in RouterOS:
- CVE-2026-67276 — SSH authentication bypass via incomplete RSA key validation, letting an attacker substitute an alternate key and gain access without the owner's legitimate private key.
- CVE-2026-67277 — a flaw in the bandwidth-test service that, with no authentication at all, allows reading kernel memory or remotely crashing and rebooting the router.
- CVE-2026-67278 — an incomplete fix in the RouterOS 7.x branch, leaving part of the original issue open.
- CVE-2026-86060 — privilege escalation via improper handling of specially crafted SSH usernames, granting an attacker administrator rights.
MikroTik shipped patches for these issues on September 3, 2026, but according to the GRFC, a significant share of devices in Russia remain unpatched — a common situation for home and small-office routers that run for years without owner intervention.
What ISPs must do now — and what it means for subscribers
Operators are asked to identify MikroTik equipment on their networks, check RouterOS versions, notify owners of vulnerable devices, and, if no update is applied within roughly a week, temporarily restrict traffic through potentially dangerous ports. In practice, this means some connections through an unpatched router may stop working until the firmware is updated — not as a penalty, but as a risk-reduction measure for the provider's entire network.
Indicators of possible compromise described by researchers include log entries such as login failure for user -2 or user added by ssh:-2, pointing to exploitation attempts via specially crafted usernames.
Why this matters even if you never bought a MikroTik yourself
MikroTik is not a niche brand — its hardware is widely used by ISPs themselves as access nodes, not only by end users as home routers. A compromised operator-side router potentially affects the traffic of every customer connected through it, not just the device owner. A router is the single point through which literally all your internet traffic passes — email, banking sessions, messaging apps. Taking control of it lets an attacker intercept unencrypted data, spoof DNS responses, and redirect victims to phishing copies of real sites.
How to check and protect your router
- Update RouterOS immediately. Open the device's web interface (Winbox or WebFig) and check the version: fixes are included in RouterOS 7.24.2, 7.23.4 (long-term), and 6.49.21 (v6 branch).
- Review the SSH user list. Unfamiliar accounts with administrator rights are a sign of compromise — remove them and change passwords for every remaining account.
- Disable bandwidth-test and internet-facing SSH access if you don't need them for everyday use — this closes the main attack path for CVE-2026-67277.
- Don't ignore a notice from your ISP if it flags your device as vulnerable — access to some services may otherwise be automatically restricted.
- Protect traffic at the device level, not just the router. A firmware update closes the vulnerability itself but doesn't restore confidentiality for traffic that already passed through a compromised node. LiMP VPN encrypts your connection on your phone and computer independently of the home network — a complementary, not a replacement, layer of protection if your ISP or home router turns out to be compromised. See plans for details.