ZoomEye scan sizes the internet's exposed MikroTik RouterOS fleet after MikroTrick disclosure

Sizing the exposed RouterOS fleet

An analysis published on dev.to sets out to quantify how much of the internet's MikroTik RouterOS population sits within reach of MikroTrick, the vulnerability chain that CERT Polska disclosed on September 5, 2026. Drawing on ZoomEye data collected on September 19, 2026, the author pairs raw population counts with an explicit accounting of what those numbers do and do not tell defenders.

What MikroTrick needs to work

MikroTrick chains two flaws. CVE-2026-67276 is a missing authentication weakness in RouterOS's SSH public-key verification path, and CVE-2026-86060 is an argument delimiter injection that elevates the session to administrator. According to the dev.to write-up, an attacker needs neither a password nor a private key; the only precondition is that the device's SSH management service is reachable over the network.

That single dependency is what makes exposure measurement the natural first step in scoping risk. A RouterOS device that is not reachable over SSH from the internet cannot be attacked through this chain, regardless of which software version it runs. Both CVEs appear in CISA's Known Exploited Vulnerabilities catalog, per the references cited in the piece.

The ZoomEye numbers

Queries run against ZoomEye on September 19, 2026 returned the following totals:

• 31,069,202 records matching app="MikroTik", the broadest fingerprint, covering any device whose signature includes MikroTik
• 2,855,574 records matching app="RouterOS", narrowed to the operating system
• 937,854 records matching app="MikroTik RouterOS", narrower still
• 8,913,154 records matching port="8291", the Winbox management port, which describes a different exposure surface than SSH

Each figure is the total number of matching records in the ZoomEye index at query time, not a count of confirmed vulnerable or compromised devices.

Three cautions from the analysis

First, fingerprint matching is not version detection. A record that identifies as RouterOS says nothing about whether the device runs a patched release such as 7.24.2 or an older, vulnerable build.

Second, the totals describe ZoomEye's index, a sampled and retained view of cyberspace, rather than a complete census of the internet.

Third, exposure is not compromise. CERT Polska has confirmed active exploitation, and public reporting cited in the article puts affected devices at more than 122,000, but that figure counts exposed and potentially vulnerable instances rather than confirmed intrusions. Conflating the two, the author warns, leads to overstated conclusions in both directions.

From population count to practical defense

The recommended workflow is to treat index counts as a candidate list and verify each device directly. Specific guidance from the analysis:

• Restrict SSH, WebFig and the bandwidth-test service to a trusted management network. Removing internet reachability eliminates the attack precondition outright.
• Check logs for SSH logins under the username -2 and audit local user accounts for unauthorized entries such as ops.
• Treat any device that reports itself as Flagged — patched builds mark themselves when they detect known tampering artifacts at boot — as compromised: isolate it, preserve evidence and rebuild rather than simply rotating credentials.

The fixed releases are listed as 6.49.21, 7.23.4, 7.24.2 and 7.25beta3, with 7.23.5 released on September 4.

Why it matters

The spread between 31 million broad fingerprint matches and the 122,000-plus affected-device estimate illustrates how easily exposure data gets misread in either direction. The value of this analysis is that it separates four distinct measurements that are routinely conflated: population, reachability, vulnerability and compromise.

For network teams running MikroTik hardware, the actionable core is simple: internet-facing management services are the precondition for the entire chain, and closing that reachability neutralizes the attack even before a patch lands. Given the sheer size of the exposed RouterOS base, that lesson will stay relevant long after this disclosure cycle ends.