Critical MikroTik Vulnerability - Patch Now, (Sun, Sep 6th)
2026-09-07T19:23:41Z•c90922370cb6c46acc3c919517c4edb0d5bd4bd656178cdfa48d2e2f47bb9dcf
AI securityAstarothGuildmaMikroTikSSH authentication bypassaccount creationactive exploitationcoding agentshoneypotincident responsenetwork appliancespatch managementpersistence
What happened
SANS ISC reports that MikroTik released a patch for an actively exploited critical vulnerability enabling SSH authentication bypass. Attackers are adding accounts to compromised devices for persistence, so organizations should assume affected devices may already be compromised, patch immediately, investigate accounts and access, and perform incident response. The feed also includes observations on malware, honeypots, and risks from exposed AI coding-agent infrastructure.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- c90922370cb6c46acc3c919517c4edb0d5bd4bd656178cdfa48d2e2f47bb9dcf
- Enrichment time
- 2026-09-07T19:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.