Advisories › MikroTik › ICSA-26-272-06
MikroTik RouterOS: 1 CVE, Critical 9.8
Summary
CISA reports 1 vulnerability in MikroTik RouterOS. Weakness type: Integer Underflow (Wrap or Wraparound). Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.
What to do: Act now: MikroTik recommends users update RouterOS to version 7.24 or later. The upgrade can be downloaded from the MikroTik website.
At a glance
- Vendor
- MikroTik
- Products
- RouterOS
- CVEs
- CVE-2026-84411
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Communications, Information Technology
- Deployed
- Worldwide
- Vendor HQ
- Latvia
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-84411 | Integer Underflow (Wrap or Wraparound) | 9.8 | – | No | The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request. |
Affected products (1)
- MikroTik RouterOS: <7.24
Vendor fixes and mitigations (from advisory)
- Vendor Fix: MikroTik recommends users update RouterOS to version 7.24 or later. The upgrade can be downloaded from the MikroTik website. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.