Security Brief/Brief

MikroTik SSH authentication bypass exploited; patch released

MikroTik released a patch late last week for an SSH authentication bypass that is already being exploited. SANS ISC advises affected organizations to assume compromise.

BriefPublished 13 September 20261 min read1 linked source · 5 checked factsRevision 4

stack of network switches with status LEDs in a rack — Illustration: Network switches arranged in a server rack with visible LED lights indicating connection status and power levels · Shixart1985 · CC BY 2.0 licence

MikroTik released a patch late last week for an SSH authentication bypass that is already being exploited, SANS ISC reports. The diary's guidance is blunt: at this point, assume compromise.

Attackers have been adding new accounts to affected devices so they keep access even after the patch is installed, which means patching alone may not evict an intruder.

For small teams running MikroTik gear, the protective step is to apply the patch and then review affected devices for accounts that should not be there.

What the reporting says

Each line below is stated by the page named above it, and only by that page.

Stated by SANS Internet Storm Center

MikroTik released a patch late last week for an already-exploited vulnerability.
The vulnerability allows an SSH authentication bypass.
The vulnerability is already being exploited.
Attackers have been adding new accounts to affected devices to maintain access after a patch is installed.
SANS ISC advises that affected organizations assume compromise.

Our view

Small teams on affected MikroTik devices should patch and then hunt for unauthorized accounts, because the diary says to assume compromise.

What the reporting says: SANS ISC reports that MikroTik released a patch late last week for an already-exploited SSH authentication bypass, and that attackers have been adding new accounts to affected devices to maintain access after a patch is installed.

Sources

SANS Internet Storm CenterPublished 13 September 2026 · checked 14 September 2026

Found through monitored feeds: SANS Internet Storm Center. A feed address is how the desk finds a story, not the evidence for it — the sources listed above are the pages the facts were taken from.

More from Security Brief

Desk homepage →

Security Brief/Report

GitLab patches maximum-severity path traversal flaw, urges self-managed users to upgrade

GitLab released fixes for a maximum-severity path traversal vulnerability, CVE-2026-85706, and a second critical flaw, CVE-2026-87719. The company urged self-managed installations to upgrade immediately,…

Report · 12 September 2026 · 1 min read

Security Brief/Brief

Microsoft's September 2026 Patch Tuesday Fixes Record 973 Vulnerabilities

Microsoft released patches for a record-breaking 973 vulnerabilities in its September 2026 Patch Tuesday, including 113 rated critical and two exploited in the wild.

Brief · 12 September 2026 · 1 min read

Security Brief/Brief

China-aligned group exploits Tencent Sogou Input Method flaw, deploys GrayRabbit backdoor

Threat actors linked to a China-aligned espionage group are exploiting CVE-2026-51990, a critical vulnerability in Tencent's Sogou Input Method for Windows, to deploy the…

Brief · 13 September 2026 · 1 min read

How this story was checked

This story was written from the 1 page listed above, all read on 14 September 2026.
Every figure and identifier in the text was required to appear in that source text before publication; any that did not was removed rather than checked by memory.
Of the 5 reported statements recorded for this story, 5 are each traceable to a linked page and are shown above. The rest were dropped.
Quantities traced to the source text: yes; identifiers traced: yes.
Where the reporting was silent, the text says so instead of filling the gap. This is a reported story, not a review of the source.