CISA flagged a MikroTik web-management bug that can root the router with one request

CISA warned on September 30 about a critical pre-authentication flaw in MikroTik RouterOS web management. A single crafted HTTP request can trigger an integer underflow in request-body handling and yield arbitrary code execution as root, or take the device down with a denial of service.

CISA does not report active exploitation of this specific bug yet. MikroTik flaws are a perennial botnet target, and recent Polish CERT reporting already covered other RouterOS chains against internet-exposed SSH. Treat any RouterOS box with web management on the public internet as overdue for isolation and an upgrade.

If WinBox or the web UI answers on the open internet, you already lost the argument about “temporary remote access.”

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

What happened

CVE-2026-84411 is a pre-auth integer underflow in RouterOS’s web-management HTTP request body handling. CISA says an unauthenticated network attacker can achieve arbitrary code execution as root or denial of service with one crafted request. Affected versions are described as RouterOS below 7.24; the vendor guidance cited by CISA is to update to 7.23 or later. Latest stable at publication was 7.24.4; latest long-term was 7.23.7 (both available since mid-September). MikroTik had not published its own security advisory at the time of the CISA alert.

Why it matters

RouterOS shows up in branch offices, MSPs, and small ISP edges — often with WinBox or WWW left reachable for vendor access. Pre-auth root on that class of device is a foothold into the LAN and a persistent redirector for the next campaign. Even without confirmed exploitation of CVE-2026-84411, the exposure pattern is the same one botnets already abuse.

What to do first

• Pull management off the internet. Restrict WWW, WinBox, API, and SSH to a management VPN or jump host. This matches CISA’s ICS-style guidance: keep control planes inaccessible from the public internet.
• Upgrade RouterOS. Move to current stable 7.24.x or long-term 7.23.x (or newer). Confirm the running version after reboot.
• Inventory every MikroTik. Include CPE loaners, lab routers, and “temporary” site kits that never entered the CMDB.
• Hunt odd admin sessions. Review local users, scheduled scripts, and recent config changes on any device that was ever internet-exposed.

Details

• CVE: CVE-2026-84411 (RouterOS web-management pre-auth integer underflow → root RCE / DoS)
• Affected (CISA): RouterOS versions below 7.24; vendor cited guidance to update to 7.23 or later
• Current builds (as of mid-Sep 2026): stable 7.24.4, long-term 7.23.7
• Exploitation: No public active exploitation reported for this CVE at alert time
• Alert: CISA September 30, 2026

Hunt / verify

• External scan for TCP 80/443/8291 (WinBox) on known MikroTik ranges; shut down any unexpected hits.
• On-device: /system resource print and /system package update to confirm version ≥ 7.23.
• Review /user print, /system script print, and recent /export diffs for unexplained changes.

MikroTik CVE-2026-84411 (pre-auth web RCE): pull WWW/WinBox off the internet, upgrade RouterOS to 7.23+/7.24.x, inventory every CPE and lab router.

Sources

• CISA ICS / RouterOS advisory covering CVE-2026-84411 (Sep 30, 2026)
• BleepingComputer: CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS (Sep 30, 2026)

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].