MikroTik RouterOS
Unauthenticated integer underflow in MikroTik RouterOS before 7.24 can give remote root code execution.
CISA advisory ICSA-26-272-06 describes CVE-2026-84411 in MikroTik RouterOS versions before 7.24. The web management service has an integer underflow in HTTP request-body handling that is reachable before authentication. An unauthenticated network attacker can use one crafted request to execute arbitrary code as root or cause a denial of service. CVSS v3.1 is 9.8 and CVSS v4.0 is 9.3; CISA reports no known public exploitation.
- CVE-2026-84411 affects RouterOS versions before 7.24.
- Pre-authentication integer underflow is in HTTP body handling.
- Impact is root remote code execution or denial of service.
- CVSS v3.1 is 9.8 and CVSS v4.0 is 9.3.
- CISA reports no known public exploitation.
- CVEs
- CVE-2026-84411
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84411 | Pre-auth integer underflow RCE in MikroTik RouterOS | 9.3 | <1% | PoC ×2 |
From the original article
2 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. The following versions of MikroTik RouterOS are affected: RouterOS <7. 24 (CVE-2026-84411) CVSS Vendor Equipment Vulnerabilities v3 9.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.