CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS
CISA warns MikroTik RouterOS below 7.24 has critical pre-auth RCE CVE-2026-84411, with no known exploitation.
CISA warned that MikroTik RouterOS contains CVE-2026-84411, a pre-authentication integer underflow in web-management HTTP request-body handling. An unauthenticated network attacker can use a single crafted request to execute code as root or cause a denial of service. CISA says versions below 7.24 are affected and that it has no knowledge of active exploitation, while also citing a vendor recommendation to update to 7.23 or later; the latest stable release mentioned is 7.24.4, and MikroTik has not published its own advisory. Separately, Poland's CERT recently warned that attackers chained CVE-2026-67276 and CVE-2026-86060 to take over devices with SSH exposed to the internet.
- CVE-2026-84411 is a pre-authentication integer underflow in RouterOS HTTP handling.
- One crafted request can yield root code execution or denial of service.
- CISA says versions below 7.24 are affected; MikroTik has published no advisory.
- CISA reports no known active exploitation of CVE-2026-84411.
- Poland's CERT recently described a separate chain using CVE-2026-67276 and CVE-2026-86060.
- Vendors
- MikroTik
- Products
- RouterOS
- Organizations
- CISACERT Polska
- Countries
- United StatesPoland
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86060+1 related CVE | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 | 6% | KEVPoC ×3 | KEV |
| CVE-2026-84411 | Pre-auth integer underflow RCE in MikroTik RouterOS | 9.3 | <1% | PoC ×2 |
From the original article
2 min read at bleepingcomputer.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a new critical vulnerability in MikroTik RouterOS that could lead to remote code execution or cause a denial-of-service condition.
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.