CISA flags critical pre-auth RCE flaw in MikroTik RouterOS

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a new critical vulnerability in MikroTik RouterOS. The flaw can lead to remote code execution or a denial-of-service condition.

Tracked as CVE-2026-84411, the issue is an integer underflow in how the RouterOS web-management service handles the body of HTTP requests. The crucial detail: the bug is reachable before authentication.

"The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication," the advisory states. According to CISA, an unauthenticated network attacker can use a single crafted request to achieve arbitrary code execution as root or to cause a denial of service.

Which versions are affected

CISA says RouterOS versions below 7.24 are affected. At the same time, the agency notes that the vendor recommends updating to version 7.23 or later. As of publication, the latest stable release is 7.24.4 and the current long-term (LTS) release is 7.23.7; both have been available since September 16. Bleeping Computer asked MikroTik and CISA to clarify the exact list of affected versions but received no reply. The vendor has yet to publish its own security advisory.

There are no public reports of active exploitation — the alert was released as a precaution. Still, MikroTik devices have long been a favorite target for attackers and botnet malware. Poland's CERT recently warned of an exploit chain combining two RouterOS flaws (CVE-2026-67276 and CVE-2026-86060) that attackers used to fully take over devices with SSH exposed to the internet.

What to do

CISA advises router owners to keep control interfaces off the internet, place control networks and remote devices behind firewalls isolated from business networks, and use updated VPNs for remote access while securing all connected devices.

Source: Bleeping Computer