Exposed Router Management: 8.09 Million RouterOS Assets and the 9,560 That Still Answer on SSH

The MikroTrick exploitation chain required one precondition to work at scale: a router whose SSH service was reachable from the internet. Measuring how many RouterOS devices meet that condition turns a vendor advisory into a concrete exposure estimate.

The vulnerability context

CERT Polska disclosed six MikroTik RouterOS vulnerabilities in September 2026 and reported that two of them were already being combined in attacks. CVE-2026-67277 is a missing authentication check for a critical function (CWE-306). CVE-2026-86060 is improper neutralization of argument delimiters (CWE-88). Together they allowed unauthenticated attackers to obtain full administrative control of devices whose SSH service was internet-exposed. CISA added both to the Known Exploited Vulnerabilities catalog on 10 September 2026.

What the measurement shows

A ZoomEye query for the RouterOS operating system fingerprint returns 8,085,997 indexed assets. This is the broad population of internet-visible RouterOS deployments, spanning routers, wireless access points and other network equipment running the operating system.

A second query that combines the RouterOS fingerprint with the SSH service returns 9,560 results. This is the more directly relevant figure. It estimates how many indexed RouterOS devices expose SSH as a reachable service, which is the condition the reported exploitation depended on.

The gap between the two numbers is informative. Roughly one in eight hundred indexed RouterOS assets answers on SSH in the index, which suggests that most deployments either do not enable SSH, do not expose it to the internet, or are not fingerprinted on that service. The 9,560 figure is therefore a floor for the exposed population rather than a ceiling, because scanning coverage and fingerprinting accuracy both affect the count.

Reading the numbers correctly

Two cautions apply to both figures.

First, an indexed asset is not a vulnerable asset. The fingerprint identifies the operating system, not the firmware version. A device running a patched RouterOS release appears in the same count as an unpatched one.

Second, exposure is not the same as compromise. An internet-reachable SSH service is a precondition, not evidence that exploitation occurred. Determining that requires log review on the device itself.

What the numbers do establish is the size of the population that needs attention. Nearly ten thousand internet-visible RouterOS devices answering on SSH is a manageable inventory for a coordinated response, and it is also a large enough target set to make automated scanning worthwhile for an attacker.

A practical verification workflow

For an organization that manages RouterOS equipment, the measurement suggests a specific order of operations.

1. Enumerate the RouterOS devices the organization owns, including equipment managed by branch offices and contractors.
2. Determine which of those devices expose SSH to the internet. This is the exposure that matters for the reported chain.
3. Compare firmware versions against the vendor's fixed releases for the deployed branch.
4. Review the user list and login logs for accounts or successful authentications that the organization did not create.
5. Inspect firewall rules, scheduled scripts and forwarding entries for unauthorized changes.

The third and fourth steps are where the vendor advisory and the exposure measurement meet. Patching removes the vulnerability; the log review determines whether the exposure was used.

Why exposure measurement is worth the effort

Network equipment is difficult to inventory because it is often managed by different teams, deployed at remote sites, and replaced infrequently. An exposure measurement provides an independent check on the internal inventory: it answers whether a device is visible from the outside, which is a property the organization may not track.

For RouterOS specifically, the measurement also quantifies how the exposure changes over time. If the count of RouterOS assets answering on SSH declines after an advisory, that is evidence that remediation is happening. If it does not, the exposure persists regardless of how many internal tickets were closed.

References

• CERT Polska advisory on MikroTik RouterOS vulnerabilities, 5 September 2026.
• MikroTik security advisories and fixed release guidance.
• CISA, Known Exploited Vulnerabilities Catalog, 10 September 2026 update.
• ZoomEye measurements of the RouterOS fingerprint, collected 20 September 2026.

Limitations

The exposure figures are ZoomEye index counts collected on 20 September 2026 using the os="RouterOS" fingerprint and the combined os="RouterOS" && service="ssh" query. They measure internet-visible, fingerprinted assets and do not indicate firmware version, patch state, or whether any device was compromised. The SSH count depends on scanning coverage and service fingerprinting and should be treated as an estimate rather than a census. Index counts change over time.