CISA warns a single unauthenticated request can root MikroTik RouterOS below 7.24
CISA says an integer underflow in MikroTik RouterOS web management gives an unauthenticated attacker root with one crafted request on versions below 7.24. No exploitation has been reported, but MikroTik's fix advice sets a 7.23 floor that CISA's own affected range still covers.
The Watch · Security desk
What happened
- CISA released the advisory on September 29, 2026, after an anonymous researcher reported the flaw to the agency.
- The same crafted request can instead be used to cause a denial of service, according to CISA.
- CISA lists the communications and information technology sectors as affected, with RouterOS deployed worldwide.
- MikroTik had not published its own security advisory for the flaw when BleepingComputer reported CISA's alert.
Why it matters
- Who has to decide decision Operators on the 7.23 long-term branch must either move to stable 7.24.4 or stay put and rely on access controls until MikroTik or CISA settles which builds are fixed.
- Who's exposed exposure Routers with web management answering from the internet or from untrusted internal segments can be attacked by anyone who can send them packets, with no credentials to steal first.
- What it sets up precedent Botnets already go after MikroTik flaws, so the gap before exploitation starts depends on how soon technical details for this one become public.
Next story · Security · Oct 9
SAML role decides which NetScaler appliances Citrix's new RCE flaw can reachConfirmed5 publishers
The preconditions are short. An attacker needs network access to the RouterOS web management service and one crafted request, with no account on the device [3]. The flaw sits ahead of the login check. "The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication," CISA wrote [2]. The weakness is filed as CWE-191, integer underflow or wraparound [4].
The version guidance does not agree with itself. CISA lists every RouterOS release below 7.24 as affected [5]. The same advisory says MikroTik recommends updating to 7.23 or later [7]. According to BleepingComputer, MikroTik's current long-term build is 7.23.7 and its current stable build is 7.24.4, both available since September 16 [12]. Read literally, 7.23.7 meets the vendor's floor and still falls inside CISA's affected range [19]. Of the two current builds, only 7.24.4 sits outside it [20]. Both had been out for 13 days when CISA published [18]. BleepingComputer asked MikroTik and CISA to clarify which versions are affected and had no answer at publication [13].
CISA's recommended practices are its standard control-system list: keep devices off the internet, put control networks behind firewalls isolated from business networks, and use updated VPNs for remote access [9]. For this bug the control that matters is narrower. The advisory's only stated precondition is network reach to the web management service [14]. Restricting which hosts can reach that service closes the path for every host outside the allowed set, whatever version the router runs [14].
Hackers and botnet malware often target MikroTik flaws, BleepingComputer reported [10]. Poland's CERT recently warned, according to BleepingComputer, that attackers chained CVE-2026-67276 and CVE-2026-86060 to take full control of RouterOS devices with SSH exposed to the internet [11]. That chain needed two flaws and an open SSH service [11]. CVE-2026-84411 needs one request to the web interface [1][3].
What to watch
- MikroTik publishing its own advisory that names fixed builds, and in particular whether 7.23.7 carries the fix.
- CISA revising the advisory's affected range to match the vendor's 7.23 floor, or MikroTik raising that floor to 7.24.
- Technical details or a proof of concept from the anonymous reporter, or a first report of exploitation to CISA.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence64
- Adoption70
- Hype gap+8
- Incentives
- Not scored
- Confidence62
Perspective Coverage
3 publishers- Builder
- Builder 27%
- Operator
- Operator 66%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-84411 is a pre-authentication integer underflow in RouterOS's web-management HTTP request handling.
- [2]
"The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication."
- [3]
"This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request."
- [4]
The relevant weakness is CWE-191 Integer Underflow (Wrap or Wraparound).
- [5]
CISA lists MikroTik RouterOS versions below 7.24 as affected by CVE-2026-84411.
- [6]
"No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time."
- [7]
MikroTik recommends users update RouterOS to version 7.23 or later.
- [8]
The CISA advisory's initial release date is 2026-09-29.
- [9]
CISA recommends minimizing network exposure so control system devices are not accessible from the internet, locating control networks and remote devices behind firewalls isolated from business networks, and using updated VPNs when remote access is required.
- [10]
Hackers and botnet malware often target MikroTik flaws.
- [11]
Poland's CERT warned that attackers used an exploit chain of two MikroTik RouterOS vulnerabilities, CVE-2026-67276 and CVE-2026-86060, to take full control of devices with SSH services exposed to the internet.
- [12]
The latest stable RouterOS version is 7.24.4 and the most recent long-term release is 7.23.7, both available since September 16.
- [13]
BleepingComputer emailed MikroTik and CISA for clarification about the RouterOS versions affected by CVE-2026-84411 and had not received a response as of publication.
- [14]
Because the flaw is reachable before authentication by an unauthenticated network attacker, network reach to the web management service is the only stated precondition, and limiting which hosts can reach it removes the path for hosts outside the allowed set.
- [15]
MikroTik has yet to publish a security advisory about the issue.
- [16]
An anonymous researcher reported the vulnerability to CISA.
- [17]
CISA lists the critical infrastructure sectors as Communications and Information Technology, with deployment worldwide and company headquarters in Latvia.
- [18]
The current builds had been available for 13 days when CISA published its advisory.
- [19]
RouterOS 7.23.7 meets MikroTik's 7.23-or-later advice but, being below 7.24, falls inside CISA's affected range as written.
- [20]
Of the two current RouterOS releases, only stable 7.24.4 sits outside CISA's affected range.
Sources
3 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCISA warns of critical pre-auth RCE flaw in MikroTik RouterOS
1 article · September 30, 2026
- cisa.govMikroTik RouterOS
1 article · September 29, 2026
- dev.toCVE-2026-84411 in MikroTik RouterOS: why a pre-authentication integer underflow reaches root
2 articles · October 4, 2026
Topics and entities
Entities
- CWE-191 Integer Underflow (Wrap or Wraparound)
- CVE-2026-67276
- CVE-2026-86060
- MikroTik
- CERT Polska
- ZoomEye
- RouterOS
- CISA