CISA Issues Advisory on Critical MikroTik RouterOS Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a security alert regarding a newly identified critical vulnerability in MikroTik RouterOS. The flaw, tracked as CVE-2026-84411, poses a significant risk due to its potential to allow remote code execution or denial-of-service conditions without requiring authentication.
Nature of the Flaw: Pre-Auth Integer Underflow
According to CISA, the vulnerability stems from an integer underflow in the web management service’s handling of HTTP request bodies. This flaw occurs during the processing of incoming web requests and is reachable before any authentication takes place, making it accessible to unauthenticated attackers on the network.
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.
Impact and Exploitation Potential
CISA emphasizes that a single specially crafted HTTP request exploiting this flaw could enable an attacker to execute arbitrary code with root privileges on the affected device. Alternatively, the same request could be used to trigger a denial-of-service condition, disrupting router functionality.
While CISA has no current evidence that CVE-2026-84411 is being actively exploited in the wild, the agency issued the advisory to ensure organizations are aware of the risk and can implement protective measures promptly.
Affected Versions and Vendor Guidance
CISA confirms that MikroTik RouterOS versions prior to 7.24 are vulnerable to CVE-2026-84411. The agency notes that MikroTik recommends users update to version 7.23 or later to mitigate the risk.
It is important to note that the latest stable release of RouterOS is version 7.24.4, and the most recent long-term release is 7.23.7. Both versions have been available since September 16, 2026.
Lack of Vendor Advisory and Ongoing Inquiry
As of the time of publication, MikroTik has not released an official security advisory addressing CVE-2026-84411. BleepingComputer reached out to both MikroTik and CISA for clarification regarding the exact scope of affected versions but had not received a response by the article’s release.
Defensive Recommendations from CISA
In the absence of a patch, CISA advises administrators of MikroTik devices to implement the following defensive actions:
- Ensure control systems are not accessible directly from the internet.
- Place control networks and remote devices behind firewalls, isolating them from business networks.
- Use updated and secure VPNs for any necessary remote access.
- Secure all connected devices to minimize potential attack surfaces.
Context: MikroTik Devices Remain a Target
Although no public exploitation of CVE-2026-84411 has been reported, MikroTik routers are frequently targeted by threat actors due to their widespread use in networking infrastructure. Recently, Poland’s Computer Emergency Response Team (CERT) warned that attackers had exploited a chain involving two other MikroTik vulnerabilities — CVE-2026-67276 and CVE-2026-86060 — to gain full control of devices with SSH exposed to the internet.
This history underscores the importance of timely patching and network segmentation for devices running RouterOS, especially those exposed to untrusted networks.
Source: BleepingComputer