Eight Million RouterOS Devices: Sizing the MikroTik Chained-Exploitation Problem from Measurement Data
MikroTik RouterOS is one of the most measurable product populations on the internet, and in September 2026 it became one of the most urgent. CERT Polska warned of in-the-wild chaining between CVE-2026-86060 and CVE-2026-67276, both rated 9.2, in which one flaw's access is combined with an uninitialized-data underflow in the UDP test component to compromise devices. The vendor released fixed builds 6.49.21, 7.23.4 and 7.24.2, and CISA added the flaws to its Known Exploited Vulnerabilities catalog.
This article uses internet measurement data to size the population at stake and discusses why router fleets resist fast patching.
Context and Method
Counts come from a ZoomEye search on September 18, 2026, using the all sub-type. Three candidate queries were tested:
| Dork | Role | Total |
| --- | --- | --- |
| os="RouterOS" | OS field | 8,085,078 |
| app="MikroTik RouterOS" | Product fingerprint | 937,854 |
| product="RouterOS" | Component field | 2,855,574 |
The os field records the operating system banner and is the broadest observation: more than 8 million devices identify as RouterOS. The application fingerprint is narrower because it requires the ZoomEye classifier to identify the full product; the component field sits between. The three observations are consistent in ordering and give a bounded picture: the exposed RouterOS population is at minimum in the hundreds of thousands and plausibly above eight million depending on identification depth.
Analysis: Why the Numbers Diverge and Why It Matters
Banner-based identification and fingerprint-based identification measure different things. A device whose service banner advertises RouterOS appears in the os count even where deeper classification fails; the app fingerprint requires positive identification of the MikroTik product. For risk sizing, the honest statement is a range: at least 937,854 devices are positively identified as RouterOS, and the banner evidence suggests the true observable population is an order of magnitude larger.
Against that population, the chained exploitation matters because of how the two flaws compose. CVE-2026-86060 provides an entry path and CVE-2026-67276 converts it into code execution through the UDP test underflow, per the CERT Polska warning. RouterOS devices are frequently ISP-managed or consumer-managed, with firmware updates applied manually or not at all. A fleet of eight million with slow update cycles and a published, actively exploited chain is a standing risk for botnet recruitment and traffic interception, categories where MikroTik devices have historically been abused.
The measurement data also supports targeted response. An ISP or enterprise holding RouterOS devices in its address space can run the same queries to enumerate its own slice of the population, then check versions against the fixed builds 6.49.21, 7.23.4 and 7.24.2. Fleet owners do not need the global count; they need their count.
Implications for Defenders
- Enumerate RouterOS devices in your managed ranges with the queries above, then verify each device's version against the three fixed builds.
- Restrict Winbox and management services to management networks. Chained exploitation requires reachability, and most fleet devices do not need public management access.
- Prioritize devices providing transit or NAT for other systems; a compromised router observes and can modify the traffic behind it.
- Treat the
os-field count as an upper observation and theappfingerprint as a floor when reporting exposure. Mixing them produces either inflated or understated claims.
Eight million is an estimate of a problem, not a count of victims. It establishes that the population at stake for the September MikroTik advisories is measured in millions, which is exactly the scale at which fleet-level patch verification, not per-device effort, is the only workable response.
References
- CERT Polska warning on chained exploitation of CVE-2026-86060 and CVE-2026-67276. https://www.cert.pl/en/news/single/
- CISA Known Exploited Vulnerabilities catalog entries for the MikroTik flaws, September 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- September 2026 weekly reporting covering RouterOS fixed builds 6.49.21 / 7.23.4 / 7.24.2. https://blog.csdn.net/weixin_41905135/article/details/165064980
