Critical MikroTik RouterOS Vulnerability Exposes Devices to Remote Code Execution
CISA warns unauthenticated attackers can exploit critical MikroTik RouterOS flaw CVE-2026-84411 for remote code execution.
CVE-2026-84411 is an integer underflow in MikroTik RouterOS versions before 7.24, scored CVSS 9.8, that can allow unauthenticated remote code execution or denial of service. CISA published ICS advisory ICSA-26-272-06 on September 29, 2026, and said it had no reports of public exploitation. The routers are widely used in enterprise, service-provider, and industrial networks; operators should upgrade to 7.24 or later.
- CVE-2026-84411 is a CVSS 9.8 integer underflow in RouterOS before 7.24.
- Unauthenticated attackers could gain remote code execution or cause denial of service.
- CISA advisory ICSA-26-272-06 cites no known public exploitation.
- Upgrade exposed MikroTik routers to RouterOS 7.24 or later.
- CVEs
- CVE-2026-84411
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84411 | Pre-auth integer underflow RCE in MikroTik RouterOS | 9.3 | <1% | PoC ×2 |
From the original article
2 min read at gbhackers.com
A critical vulnerability in MikroTik RouterOS could allow unauthenticated remote attackers to execute code on vulnerable devices or trigger a denial-of-service condition. This vulnerability, tracked as CVE-2026-84411, affects MikroTik RouterOS versions earlier than 7. 24 and carries a CVSS v3 severity score of 9.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.