MikroTik Routers Under Attack: Internet-Exposed SSH Exploited for Unauthenticated Administrative Access

CERT Polska has issued a warning about attackers exploiting MikroTik routers with internet-exposed Secure Shell (SSH) remote-access services to gain full administrative control without authentication. Successful attacks date back to at least September 2, 2026, and MikroTik has released security updates to fix the vulnerabilities. Users are advised to immediately install the fixes and check for unauthorized configuration changes.