CISA 2026-09-29

MikroTik RouterOS

CVE-2026-84411

Machine-generated analysis · WAYSCloud LLM

RouterOS versions prior to 7.24 contain an unauthenticated integer underflow in the web management service.

Context

The advisory concerns MikroTik RouterOS, a network operating system for routers. It states that an integer underflow in HTTP request body handling can be exploited without authentication to achieve root code execution or cause denial of service. The vulnerability is identified as CVE-2026-84411 and carries a CVSS base score of 9.8. The advisory notes the product is deployed worldwide in communications and IT sectors.

Operator considerations

Check: inventory RouterOS versions and identify any that are earlier than 7.24.
Isolate: limit external network access to the web management interface.
Patch: upgrade affected devices to RouterOS 7.23 or later as recommended by MikroTik.
Log: monitor HTTP request traffic to the management service for malformed or unusually large bodies.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service.

The following versions of MikroTik RouterOS are affected:

RouterOS

Read the full advisory on CISA →