CVE-2026-67276: MikroTik RouterOS SSH Zero-Day Exploited in Router Takeover Attacks

**MikroTik RouterOS emergency updates:** CERT Polska and MikroTik disclosed CVE-2026-67276 (SSH RSA public-key validation bypass, CVSS 9.2) which, when chained with CVE-2026-86060 (SSH username privilege-manipulation), enables unauthenticated full administrative takeover of internet-exposed RouterOS devices; active exploitation was observed beginning Sept 2, 2026 with IOCs (e.g., 82.192.72.4, 103.102.31.18, abnormal SSH username "-2", and a created 'ops' account), and vendors recommend immediate patching, log/config inspection, and factory resets for compromised units.