Poland orders its national cybersecurity entities to update MikroTik RouterOS now, as attackers exploit the flaws

Poland orders its national cybersecurity entities to update MikroTik RouterOS now, as attackers exploit the flaws

2 October 2026: Poland's Government Plenipotentiary for Cybersecurity issued a formal recommendation on 2 October 2026 to entities in the country's national cybersecurity system, the operators of essential and important services under Polish law, to update MikroTik RouterOS "without delay" because the flaws are being exploited. The recommendation was prepared with Poland's three national CSIRTs: CSIRT NASK, CSIRT GOV and CSIRT MON, which assessed a risk of critical incidents if it is not followed.

Not yet independently verified. The Polish recommendation names fixed versions but no CVE numbers. MikroTik's revised notice of 6 October lists the six CVEs from CERT Polska's report, which is the basis for matching them.

Update, 26 October 2026: MikroTik revised its notice on 6 October. It now lists all six CVEs from CERT Polska's report (CVE-2026-67279, the SSH flaw exploited in the wild, plus CVE-2026-86060, CVE-2026-67276, CVE-2026-67281, CVE-2026-67278 and CVE-2026-67277) and says the fix for CVE-2026-67278, which let a router accept forged TLS certificates and SSH host keys, was incomplete in 7.24.2 and 7.23.4. The complete fix is in 7.24.3 (stable) and 7.23.6 (long-term); routers updated in September to the versions named below should be updated again. RouterOS 6 is not affected by that flaw, so 6.49.21 stays current. CISA added CVE-2026-67279 to its Known Exploited Vulnerabilities catalogue on 25 September.

What it requires

• Update RouterOS to at least the fixed release of your branch: 7.25 beta 3, 7.24.2, 7.23.4 or 6.49.21. These are the releases MikroTik's September vulnerability notice lists as fixed.
• Check whether devices were compromised, following MikroTik's instructions. MikroTik's notice says devices may show a "Flagged" status in the system log if compromised.
• Disable or block access from untrusted networks to SSH, the web interface (WWW and WWW-SSL), WinBox and the bandwidth-test server.

The recommendation says non-compliance has a negative impact on public safety and vital state security interests.

Why it matters beyond Poland

The fixed versions and the advice apply to every MikroTik device, wherever it is. CERT Polska reported in early September that the flaws were being exploited; a government now issuing a formal order a month later suggests many devices are still unpatched. MikroTik routers are common in branch offices, at internet providers and in industrial sites, and are often managed by a third party that customers never check.

What to do

• Inventory every MikroTik device, including those your internet or managed-network provider installed, and confirm the RouterOS version.
• Update to the fixed release of your branch, or later; our 1 October item covers a separate flaw fixed in 7.24.
• Check the system log for a "Flagged" status and for unknown users, scripts and scheduled tasks.
• Close SSH, web, WinBox and bandwidth-test access from the internet; manage devices over a VPN.
• In Poland, entities in the national cybersecurity system should record what they did, as the recommendation is formal.

Sources

• Ministry of Digital Affairs (Poland): Recommendation of the Government Plenipotentiary for Cybersecurity on MikroTik software - 2 October 2026
• CERT Polska: Vulnerabilities in MikroTik RouterOS actively exploited - 5 September 2026
• MikroTik: September 2026 vulnerability notice - 3 September 2026
• MikroTik: September 2026 vulnerability notice (updated 6 October 2026) - 6 October 2026
• CISA Known Exploited Vulnerabilities catalogue: CVE-2026-67279, MikroTik RouterOS (added 25 September 2026) - 25 September 2026