Three stories dominate this morning. Network edge infrastructure, remote management platforms, and e-commerce applications are all under active attack - and in two of the three cases, patches either just landed or do not exist yet. The common thread is unauthenticated access to systems that should never be reachable without strong authentication.

In the News

MikroTik RouterOS Flaws Chained for Unauthenticated SSH Hijacking

Attackers are chaining multiple newly disclosed vulnerabilities in MikroTik RouterOS to gain full administrative control over routers with internet-exposed SSH services. CERT Polska confirms active exploitation since at least September 2, 2026. The attack requires no credentials - the chain achieves unauthenticated access and escalates to full router admin.

MikroTik routers are ubiquitous in small and mid-sized enterprise branch networks, ISP customer premises equipment, and IoT gateway deployments. A compromised edge router gives the attacker a pivot point into the internal network, the ability to intercept and modify traffic, and a persistent foothold that most endpoint detection tools never see - EDR does not run on routers.

The immediate risk is broad. Shodan consistently indexes hundreds of thousands of MikroTik devices with SSH exposed to the internet. Organizations that deployed MikroTik as affordable branch CPE years ago and have not maintained firmware updates are the primary target. CVE identifiers have not yet been formally assigned, which complicates vulnerability scanner coverage - defenders cannot rely on automated scanning to find this. Manual audit of RouterOS version and SSH exposure is required.

What defenders should do: Update RouterOS to the latest stable release immediately. Disable internet-facing SSH. Restrict SSH to management VLANs with ACLs. Audit router configurations for unauthorized admin accounts and SSH keys added since September 2. Monitor for anomalous outbound connections from router management interfaces - compromised routers are often enrolled in botnets or used as proxy infrastructure.

N-able Ships Fourth N-central RCE Hotfix in Five Weeks

N-able has released its fourth emergency hotfix for unauthenticated remote code execution in its N-central remote monitoring and management (RMM) platform. The flaw carries a CVSS 10.0 score and affects all on-premises N-central builds below version 2026.3.1.14. The vendor confirms active exploitation.

Four critical hotfixes in five weeks for the same product is not a patching cadence - it is triage on a platform under siege. RMM platforms are high-value targets because they hold privileged access to every managed endpoint. A single compromised N-central instance gives attackers administrative control over potentially thousands of customer devices. This is supply-chain risk materialized through the management layer.

MSPs running on-prem N-central should treat this as an emergency. The management plane must be segmented from production networks, admin access must require MFA, and network-level controls should restrict which systems can reach the N-central console. Organizations that outsource IT management should ask their MSP directly: “What RMM platform do you use, what version is it running, and is it patched?”

What defenders should do: Apply hotfix 2026.3.1.14 immediately. Segment the RMM server from production networks. Enforce MFA on all administrative access. Review RMM audit logs for unauthorized remote sessions since August 1.

Adobe Commerce Zero-Day Backdoors Online Stores

A zero-day dubbed “StyleSmuggler” is being actively exploited to achieve remote code execution on Adobe Commerce and Magento e-commerce platforms. Attackers are using the flaw to deploy persistent backdoors on storefronts - backdoors that survive standard remediation steps because they embed within theme template files that are rarely audited.

No patch is available. Adobe has not yet released a fix, which means every Adobe Commerce and Magento store is relying on compensating controls. The attack vector appears to target the template rendering engine, allowing code injection through manipulated style-related assets - hence the name StyleSmuggler.

E-commerce platforms process payment card data, making them PCI DSS scope. A persistent backdoor on a storefront is a potential card skimming operation. Retailers and payment processors should be treating this as a PCI incident investigation trigger, not just a vulnerability management ticket.

What defenders should do: Deploy web application firewall rules with virtual patching for the affected template rendering paths. Audit theme directories for unauthorized file modifications. Monitor for outbound connections from web servers to unknown infrastructure. File integrity monitoring on the Magento/Commerce codebase is the primary detection control until a patch ships.

Weaponized ScreenConnect Clients Spread Like a Worm

Attackers are modifying ScreenConnect remote access clients so that compromised instances automatically propagate payloads to every newly connected client. The result is worm-like lateral movement through remote support infrastructure - one compromised ScreenConnect server seeds malware to every device that connects to it.

This campaign is separate from but thematically related to the new ScreenConnect vulnerability ConnectWise disclosed this week with only temporary mitigations and no patch. Remote management tools remain one of the most dangerous attack surfaces in enterprise environments because they are designed to have the exact level of access attackers want - remote admin on every endpoint.

What defenders should do: Audit all approved remote access tools in the environment. Monitor for unauthorized ScreenConnect installations. Enforce application allowlisting on endpoints to prevent unapproved remote access binaries from executing.

Defender Action Items

  • MikroTik: Update RouterOS to latest stable; disable internet-facing SSH; audit for unauthorized admin accounts and SSH keys added since September 2
  • N-able N-central: Apply hotfix 2026.3.1.14; segment RMM servers from production; enforce MFA on admin access; review audit logs for unauthorized sessions since August 1
  • Adobe Commerce / Magento: Deploy WAF virtual patching; run file integrity monitoring on theme directories; monitor for outbound C2 from web servers
  • ScreenConnect: Audit approved remote access tools; apply ConnectWise temporary mitigations; enforce application allowlisting to block unapproved remote access binaries
  • JSCeal (Google 2FA bypass): Enforce device-bound session credentials where available; deploy browser isolation for high-privilege users; monitor for anomalous session cookie reuse across geolocations

Detection Queries

MikroTik routers compromised via SSH typically exhibit outbound connections to C2 infrastructure from the router management interface. If your MikroTik devices log to a central syslog, the following Splunk SPL query identifies SSH login successes from non-management source IPs - an indicator of unauthorized access via the exploited chain:

index=network sourcetype=mikrotik_syslog "user logged in"
| rex field=_raw "from (?<src_ip>\d+\.\d+\.\d+\.\d+)"
| where NOT cidrmatch("10.0.0.0/8", src_ip) AND NOT cidrmatch("172.16.0.0/12", src_ip) AND NOT cidrmatch("192.168.0.0/16", src_ip)
| stats count by src_ip, host
| where count > 1
| sort -count

This query filters for SSH logins from public IP addresses to MikroTik devices. Expect near-zero false positives in environments where SSH is properly restricted to internal management networks. Any hits after September 2 warrant immediate investigation.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.