Critical MikroTik RouterOS Flaw Could Give Attackers Root Access

CISA has warned that a critical MikroTik RouterOS flaw could let remote attackers execute code with root privileges without logging in. The vulnerability, CVE-2026-84411, could also cause a denial of service through a single specially crafted request.

However, the agency says it has no knowledge of active exploitation. Its advisory also contains conflicting version information, leaving uncertainty about which releases fully address the issue.

Web Management Weakness Requires No Login

The vulnerability involves an integer underflow in how the RouterOS web management service processes HTTP request bodies.

Because attackers can reach the vulnerable functionality before authentication, they do not need valid credentials to attempt exploitation. They would, however, need network access to the affected service.

According to CISA, one crafted request could trigger arbitrary code execution with root privileges. Alternatively, an attacker could use the weakness to disrupt the device’s operation.

Root access would give an attacker extensive control over the affected system. Consequently, the vulnerability presents a serious risk wherever untrusted networks can reach vulnerable management services.

Conflicting Version Guidance Leaves Questions Open

CISA lists RouterOS versions below 7.24 as affected. However, the same advisory says MikroTik recommends upgrading to version 7.23 or later to mitigate the risk.

Those statements leave the status of the 7.23 release branch unclear. Therefore, the advisory does not provide a consistent answer about the minimum version needed to address the MikroTik RouterOS flaw.

At the time of the September 30 report, RouterOS 7.24.4 was the latest stable release. Meanwhile, 7.23.7 was the latest long-term release. Both became available on September 16.

MikroTik had not published a separate security advisory at that point, and the conflicting guidance remained unresolved.

CISA Advises Restricting Network Access

Alongside its warning, CISA outlined defensive measures to reduce exposure.

First, organizations should keep control systems inaccessible from the internet. They should also place control networks and remote devices behind firewalls and separate them from business networks.

For remote access, CISA recommends updated VPNs and appropriate protection for connected devices.

These measures can limit access to vulnerable services. However, organizations still need clear version guidance to determine whether their installed software addresses the flaw.

Earlier Router Attacks Involved Different Vulnerabilities

Separately, Poland’s CERT recently reported attacks involving two other RouterOS vulnerabilities: CVE-2026-67276 and CVE-2026-86060.

Attackers chained those weaknesses to take full control of devices with internet-exposed SSH services.

Those incidents demonstrate continued targeting of MikroTik equipment. However, they do not establish exploitation of CVE-2026-84411, which CISA had not linked to known attacks when it issued its warning.