In short: On September 3, 2026, MikroTik silently pushed emergency RouterOS updates across all active branches — without disclosing the vulnerability. Latvia's CERT.LV confirmed active exploitation is already underway: compromised routers show an unauthorized admin account named "ops". Devices are used worldwide by ISPs, offices, and home power users. If you run MikroTik hardware, check your user list and update today.
What happened: MikroTik's silent patch
On September 3, 2026, MikroTik simultaneously released RouterOS 7.24.2 (stable), 7.23.4 (long-term), 6.49.21 (v6 branch), and 7.25 beta 3 — all on the same day. Release notes contained no CVE identifier, no vulnerability description, and no technical details. The only message: a security issue had been found and users should upgrade urgently.
The following day, September 4, MikroTik published an official security notice explaining the approach: technical details are being withheld to give users time to patch before that information reaches threat actors. This is coordinated disclosure with a delayed technical release.
Security researcher Nick Pratley independently reverse-engineered the patch and published a technical analysis. He identified a stack buffer overflow in a low-level RouterOS service: sending 542 bytes of 'A' followed by 'BBBB' produced eip=0x42424241 and a controlled stack state — a textbook exploitable overflow signature. RouterOS itself now checks for known compromise indicators after upgrade and marks affected devices as "Flagged".
The attack signature: an "ops" account in your user list
The most alarming development is that exploitation was already active before the patch. Latvia's national CERT, CERT.LV, reported intensified attack attempts targeting MikroTik routers. Multiple network administrators in professional forums described an identical post-compromise artifact: a rogue admin account named "ops" appearing in the device's user list.
One administrator found the "ops" account on more than half of client routers under their management — a clear sign of automated, at-scale exploitation using an exploit that was not publicly known at the time.
A critical nuance: after updating, RouterOS sets a "Flagged" status if it detects compromise indicators. But updating alone does not remove malicious accounts or configuration changes. Manual cleanup is required.
Why a compromised router is worse than a compromised device
A hacked router is a critical breach because it sits upstream of every device on your network — phones, laptops, smart TVs, everything. An attacker with router access can:
- Hijack DNS responses — silently redirect you to fake banking, email, or shopping pages that look identical to the real ones.
- Read unencrypted traffic — any HTTP connection becomes fully visible to the attacker.
- Maintain persistent access — the "ops" backdoor account lets the attacker return at will, even after you change your primary admin password.
- Pivot to other devices — use your router as a launching pad for attacks on your local network or recruit it into a botnet.
LiMP VPN creates an encrypted tunnel from your device outward, bypassing your local router as a trust point: even if the router is compromised, intercepting or spoofing your VPN traffic is substantially harder for an attacker. This becomes an especially valuable layer when you don't fully control the router — for example, when using ISP-provided equipment or traveling. It complements, not replaces, patching your hardware.
How to check and secure your MikroTik device right now
1. Update immediately. Open Winbox or the RouterOS web interface → System → Packages → Check For Updates. Install 7.24.2 (stable), 7.23.4 (long-term), or 6.49.21 (v6). After updating, RouterOS will scan for compromise indicators automatically.
2. Audit your user accounts. In Winbox: System → Users. Look for accounts you did not create — especially "ops". If found: delete it, rotate all admin passwords, and audit your firewall rules for unknown entries.
3. Restrict external management access. WinBox (port 8291), WebFig (80/443), and SSH (22) should only be reachable from trusted IPs or your internal management network — never from the open internet. This is a baseline security requirement for any network device.
4. Review your logs. In Winbox: Log → look for suspicious login attempts, configuration changes, or unfamiliar source IPs in the past several days.
5. Separate your management VLAN. Isolate the router's management interface from client-facing networks to contain the blast radius of any future compromise.
For traffic-level protection, LiMP VPN encrypts your connection end-to-end, shielding your browsing from network-level interception regardless of what happens at the router layer. Our zero-logs policy means no record of your sessions is ever stored.