MikroTik RouterOS
Unauthenticated integer underflow in MikroTik RouterOS before 7.24 can give remote root code execution.
80
CVE-2026-84411
Pre-auth integer underflow RCE in MikroTik RouterOS
- CVSS 4.0
- 9.3 critical
- EPSS
- <1%p59
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-84411 is a critical integer underflow (CWE-191) in the HTTP request-body handling of the RouterOS web management service. The flaw is reachable before authentication, so an unauthenticated attacker on the network can trigger it with a single crafted HTTP request. Successful exploitation can yield arbitrary code execution as root or a denial of service, with a CVSS 4.0 score of 9.3. It affects MikroTik RouterOS builds covered by the vendor advisory AV26-992; exact version ranges are not given in the source data. CISA’s Known Exploited Vulnerabilities catalog does not list it, and no public proof-of-concept is known.
What to do: Treat the RouterOS web management service as untrusted until it is patched: do not expose it to the internet or untrusted networks, and restrict it to a management VLAN or VPN. Apply the fixed RouterOS release from MikroTik advisory AV26-992 as soon as it is identified for your branch; the source data does not name a fixed version. After patching, review logs and device integrity for unexpected reboots or signs of root-level compromise.
| Product | Affected |
|---|---|
| MikroTik RouterOS | — |
Estimated exposure
largeOn the order of 100,000+ internet-reachable MikroTik devices potentially, with the affected-version subset unknown — MikroTik RouterOS is widely deployed on ISP and small-business routers, and public internet scans have historically shown on the order of hundreds of thousands of reachable MikroTik management interfaces; the share running an affected…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.
- Weakness
- CWE-191
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
5 storiesCritical MikroTik RouterOS Flaw Lets Unauthenticated Attackers Execute Code as Root
Unauthenticated MikroTik RouterOS flaw CVE-2026-84411 could let remote attackers execute code as root.
74
CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS
CISA warns MikroTik RouterOS below 7.24 has critical pre-auth RCE CVE-2026-84411, with no known exploitation.
74
Critical MikroTik RouterOS Vulnerability Exposes Devices to Remote Code Execution
CISA warns unauthenticated attackers can exploit critical MikroTik RouterOS flaw CVE-2026-84411 for remote code execution.
74
MikroTik security advisory (AV26-992)
Canada's Cyber Centre urges updates for MikroTik RouterOS before 7.24 over CVE-2026-84411.
36