The U.S. Cybersecurity and Infrastructure Security Agency has issued a warning regarding a critical vulnerability affecting MikroTik RouterOS that enables remote code execution or denial-of-service attacks. Designated as CVE-2026-84411, the flaw stems from a pre-authentication integer underflow within the router's web-management HTTP request handling mechanism.

According to CISA's alert, "The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request."

A single malicious request crafted by an attacker could result in code execution running at root level or trigger a denial-of-service condition. While CISA has no indication of active exploitation in the wild, the agency released the advisory to help organizations understand the threat and implement protective measures.

RouterOS versions prior to 7.24 are vulnerable to this flaw, though MikroTik recommends upgrading to version 7.23 or later. The vendor released version 7.24.4 as the latest stable build and 7.23.7 as the most recent long-term support release, both made available on September 16.

MikroTik has not yet published its own security advisory addressing CVE-2026-84411. Attempts to obtain clarification from both the vendor and CISA regarding affected versions have not yielded responses at the time of writing.

Recommended defensive actions

CISA has outlined several steps for organizations operating MikroTik routers:

  1. Prevent control systems from being accessible directly from the internet
  2. Segment control networks and remote devices behind firewalls, keeping them isolated from business infrastructure
  3. Deploy current VPN solutions for remote access and ensure all connected systems are patched

Historical pattern of MikroTik exploitation

Although CVE-2026-84411 has not been observed in active attacks, MikroTik devices remain frequent targets for malicious actors and botnet operators. Poland's CERT agency recently disclosed that attackers exploited a chain of two RouterOS vulnerabilities—CVE-2026-67276 and CVE-2026-86060—to gain complete control of devices with SSH access exposed to the internet.