Critical MikroTik RouterOS Flaw Lets Unauthenticated Attackers Execute Code as Root
Unauthenticated MikroTik RouterOS flaw CVE-2026-84411 could let remote attackers execute code as root.
CISA advisory ICSA-26-272-06, published September 29, 2026, covers CVE-2026-84411, an integer underflow in MikroTik RouterOS versions before 7.24. The flaw is scored CVSS 9.8 and could let unauthenticated remote attackers execute code as root or cause a denial of service. CISA said it has no reports of public exploitation. The fix is RouterOS 7.24 or later, and management interfaces should not be exposed to the internet.
- CVE-2026-84411 is an integer underflow in RouterOS before 7.24, CVSS 9.8.
- Unauthenticated attackers could execute code as root or cause denial of service.
- CISA advisory ICSA-26-272-06 reports no known public exploitation.
- Upgrade to RouterOS 7.24 or later and lock down management access.
- CVEs
- CVE-2026-84411
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84411 | Pre-auth integer underflow RCE in MikroTik RouterOS | 9.3 | <1% | PoC ×2 |
From the original article
2 min read at cybersecuritynews.com
A critical vulnerability in MikroTik RouterOS could allow unauthenticated remote attackers to execute arbitrary code with root-level privileges or trigger a denial-of-service condition. The flaw, tracked as CVE-2026-84411, affects MikroTik RouterOS versions before 7. 24 and has a CVSS v3 severity score of 9.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.