CISA Warns of Critical Pre-Auth Code-Execution Flaw in MikroTik RouterOS
Summary
CISA warns that CVE-2026-84411 can let unauthenticated attackers execute code as root or cause denial of service on affected MikroTik RouterOS versions. No active exploitation is known; version guidance remains unclear.
Key points
- CVE-2026-84411 is an integer underflow in RouterOS web-management HTTP request handling, reachable before authentication.
- A single crafted request could enable root-level code execution or cause denial of service.
- CISA says RouterOS versions below 7.24 are affected, while the vendor's cited update guidance says version 7.23 or later; BleepingComputer says it sought clarification.
- CISA reports no known active exploitation of this vulnerability, and MikroTik had not published a security advisory at the time of the article.
- CISA recommends keeping control systems off the public internet, segmenting networks behind firewalls, and securing remote access with updated VPNs.
Article Details
- Vulnerability Types
- Pre-authentication integer underflow
- Remote code execution
- Denial of service
- Severity
- Critical
- Affected Versions
- MikroTik RouterOS versions below 7.24
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- unknown
- Workarounds
- Keep control systems inaccessible from the internet.
- Place control networks and remote devices behind firewalls and isolate them from business networks.
- Use updated VPNs for remote access and secure all connected devices.
MITRE ATT&CK
CVE
CVE-2026-67276Mikrotik · RouterosCERT agency warned that attackers used an exploit chain of two MikroTik RouterOS vulnerabilities, CVE-2026-67276 and CVE-2026-86060, to take full control of devices with SSH services exposed to the internet.CVE-2026-84411MikroTik · RouterOSCISA has warned about CVE-2026-84411, a critical pre-authentication integer underflow in MikroTik RouterOS that can allow unauthenticated attackers to execute code as root or trigger a denial of service with a singleCVE-2026-86060Mikrotik · Routerosthat attackers used an exploit chain of two MikroTik RouterOS vulnerabilities, CVE-2026-67276 and CVE-2026-86060, to take full control of devices with SSH services exposed to the internet.