CISA warned that a critical flaw in MikroTik RouterOS can let an outsider seize control of affected routers without needing a password. The bug, CVE-2026-84411, is a pre-authentication integer underflow in the web-management HTTP request handler that can lead to remote code execution as root or denial of service with a single crafted request. CISA said RouterOS versions below 7.24 are affected, while MikroTik guidance cited by CISA points users to 7.23 or later, creating version ambiguity the vendor had not yet clarified at publication.
Why it matters: Organizations and users running exposed MikroTik routers could face full device compromise from a single network request, so this is urgent even without confirmed in-the-wild exploitation. Owners should update to the latest fixed RouterOS release as soon as vendor guidance is clarified and keep management interfaces off the public internet.
Bill Toulas
2026.09.30
100% relevant
This article establishes a distinct new event: CISA publicly warning about CVE-2026-84411, a newly identified critical pre-authentication RouterOS RCE flaw separate from the previously tracked MikroTik exploit chain involving CVE-2026-67276 and CVE-2026-86060.
← Back to all stories