Reported by 8 outlets

Timeline

1. original reporting

   Critical MikroTik RouterOS Flaw Lets Unauthenticated Attackers Execute Code as Root

   cyberpress.org · 13d ago · September 30th, 2026

   A critical vulnerability in MikroTik RouterOS could allow unauthenticated remote attackers to execute arbitrary code with root privileges or trigger a denial-of-service condition on affected devices. Tracked as CVE-2026-84411, the flaw affects RouterOS versions earlier than 7.24 and carries a CVSS v3 score of 9.8. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) disclosed the issue on September 29, 2026, through Industrial Control Systems Advisory ICSA-26-272-06. MikroTik routers are widely deployed across communications and information-technology environments worldwide, making the vulnerability particularly significant for organizations that expose management services or router interfaces to untrusted networks. Critical MikroTik RouterOS Flaw CVE-2026-84411 is classified as an integer underflow, also known as an integer wraparound vulnerability. Such flaws occur when software performs arithmetic on a value that falls below its minimum supported range, causing it to wrap to a large positive value or otherwise produce an unexpected result. In RouterOS, an attacker could potentially exploit the vulnerable condition remotely without authenticating to the target device. Successful exploitation could result in remote code execution as root, the highest privilege level on RouterOS, giving an attacker the ability to alter router configurations, establish persistence, intercept or redirect network traffic, deploy additional payloads, or use the device as a foothold fo

2. update from cisa.gov

   MikroTik RouterOS Advisory ICSA-26-272-06

   cisa.gov · 15d ago · September 29th, 2026

   CISA published ICSA-26-272-06 on September 29, 2026, one day before the story's first news coverage. The advisory documents CVE-2026-84411 as an integer underflow (CWE-191) in the HTTP request body handling of the RouterOS web management service, reachable before authentication, letting a single crafted request from an unauthenticated attacker achieve code execution as root or cause denial of service. It scores the flaw CVSS v3.1 9.8 and CVSS v4.0 9.3, lists affected versions as RouterOS below 7.24 with a vendor fix of 7.23 or later, credits an anonymous researcher, and states that no known public exploitation targeting this vulnerability had been reported to CISA at publication.

3. mentioned by gbhackers.com

   Critical MikroTik RouterOS Vulnerability Exposes Devices to Remote Code Execution

   gbhackers.com · 13d ago · September 30th, 2026

4. update from bleepingcomputer.com

   CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS

   bleepingcomputer.com · 13d ago · September 30th, 2026

   “This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.” Although the agency has no knowledge of the vulnerability being actively exploited, it released the advisory to alert organizations of the risk and to provide defensive measures. However, the agency also says that the vendor recommends that users update to version 7.23 or later to mitigate the risk. It should be noted that the latest stable version of MikroTik RouterOS is 7.24.4, while the most recent long-term release is 7.23.7, both available since September 16. BleepingComputer has emailed both MikroTik and CISA for clarification about the RouterOS versions affected by CVE-2026-84411, but we have

5. update from www.bleepingcomputer.com

   "CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS" "[...] Cybersecurity and Infrastructure Security Agency (CISA) is warning of

   www.bleepingcomputer.com · 13d ago · September 30th, 2026

   "CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS" "[...] Cybersecurity and Infrastructure Security Agency (CISA) is warning of

   via Mastodon https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-pre-auth-rce-flaw-in-mikrotik-routeros/

6. mentioned by www.bleepingcomputer.com

   🤖 CVE-2026-84411: pre-auth integer underflow in MikroTik RouterOS web-management HTTP body handling. A single crafted request gives unauthen

   www.bleepingcomputer.com · 13d ago · September 30th, 2026

7. update from malware.news

   MikroTik security advisory (AV26-992)

   malware.news · 11d ago · October 2nd, 2026

   Serial number: AV26-992 Date: October 2, 2026 As of September 29, 2026, MikroTik is affected by vulnerabilities in the following product: RouterOS Prior to 7.24 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

8. mentioned by www.bleepingcomputer.com

   # CISA warns of critical pre-auth RCE flaw in # MikroTik # RouterOS https://www. bleepingcomputer.com/news/secu rity/cisa-warns-of-critical-

   www.bleepingcomputer.com · 11d ago · October 2nd, 2026

9. mentioned by radar.offseq.com

   CVE-2026-84411 (CRITICAL, CVSS 9.8) affects MikroTik RouterOS https:// radar.offseq.com/threat/cve-20 26-84411-cwe-191-in-mikrotik-routeros-

   radar.offseq.com · 11d ago · October 3rd, 2026

10. mentioned by censys.com

    🚨 RAPID RESPONSE: CVE-2026-84411 is a critical unauthenticated remote code execution vulnerability affecting MikroTik RouterOS web managemen

    censys.com · 8d ago · October 5th, 2026