Cybersecurity
CISA warns of critical pre-auth RouterOS flaw
CISA warned that a pre-authentication integer underflow in MikroTik RouterOS could let an unauthenticated attacker run code as root or cause denial of service with one crafted request.
- CISA warned about a new critical vulnerability in MikroTik RouterOS.
- It identified the issue as CVE-2026-84411 and said it was an integer underflow in the software’s web-management HTTP request handling before authentication.
- CISA said a single crafted request could give an attacker root code execution or denial of service, and it said it had no knowledge of active exploitation.
- CISA said RouterOS versions below 7.24 were affected, while the vendor had recommended updating to 7.23 or later.
- The article said MikroTik had not yet published its own security advisory, and that Poland’s CERT agency had recently warned about other RouterOS flaws used in a takeover chain.
CISA warned about a new flaw in MikroTik RouterOS and said it was tracked as CVE-2026-84411. The agency said the problem was an integer underflow in the web-management request path that could be reached before a user logged in.
According to CISA, an unauthenticated attacker could use one malformed request to run code with root privileges or force a denial of service. The agency said it had no evidence that the issue was being exploited in the wild.
CISA said RouterOS releases below 7.24 were affected, but it also said MikroTik had advised users to update to 7.23 or later. The article said the latest stable release was 7.24.4 and the long-term release was 7.23.7, both available since 16 September.
BleepingComputer said it had contacted MikroTik and CISA for clarification and had not received a reply by publication. It also said MikroTik had not yet issued its own advisory, and noted that Poland’s CERT agency had recently warned about attackers chaining two other RouterOS flaws to take control of internet-facing SSH devices.
Named in this story
Companies
- MikroTik
- made RouterOS and had not yet published a security advisory
Governments and agencies
- The U.S. Cybersecurity and Infrastructure Security Agency
- issued the warning and mitigation advice
- Poland’s CERT agency
- previously warned about chained RouterOS exploits
Products and systems
- RouterOS
- contained the affected web-management service
How the source tells it
The piece was a straightforward security advisory, with urgency coming from CISA’s warning language rather than from any editorial flourish.
- alarm the flaw was labelled critical and described as allowing code execution as root
- urgency the advisory was issued to warn organisations and set out defensive steps