Attackers Exploiting MikroTik Routers via Internet-Exposed SSH

Attackers are actively exploiting MikroTik routers with internet-exposed Secure Shell (SSH) remote-access services to gain full administrative control without authentication, according to a warning from CERT Polska. Successful attacks have been observed since at least September 2, 2026. MikroTik has released security updates for affected RouterOS versions (6.49.21, 7.23.4, 7.24.2) and recommends immediate installation to prevent further exploitation.