One HTTP request is enough to become root on MikroTik routers on 7.23
CVE-2026-84411, scored CVSS 9.8, is an integer underflow in RouterOS’s web management service, reachable before authentication with a single crafted request that yields root code execution. Any MikroTik router whose web interface is reachable from the internet must move to 7.24 or pull that interface off the network.
September 29, 2026. CISA publishes advisory ICSA-26-272-06 on CVE-2026-84411, a critical flaw in MikroTik’s RouterOS. September 29, 2026. The vulnerability, scored CVSS 9.8, is an integer underflow in the HTTP request-body handling of the web management service, reachable before authentication. September 29, 2026. MikroTik confirms that all versions before 7.24 — including the RouterOS v6 branch — are affected whenever the web interface is reachable by an attacker. Why it matters: a single crafted request is enough to run root code on a router, and MikroTik routers are exposed to the internet at massive scale.
An underflow reachable before you even log in
The mechanics of CVE-2026-84411 fit in one line, but the consequences are heavy. RouterOS’s web management service contains an integer underflow (CWE-191) in its HTTP request-body handling. Because the defect is reachable before authentication, a network attacker — no account, no session, no user interaction — can send one single request to obtain arbitrary code execution with root privileges, or trigger a denial of service.
The CVSS 3.1 vector leaves no room for debate: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Network reachable, low complexity, no privileges required, no interaction, full confidentiality-integrity-availability impact. That is the definition of a 9.8. The CVSS 4.0 rating, at 9.3, confirms it. When a device as cheap and widespread as a MikroTik router ships a flaw of this class, the realistic exposure is enormous even before anyone reports an exploit — and public advisories are the starting gun for the scanning that follows.
The affected footprint is broad by construction. RouterOS powers MikroTik routers and access points — cheap, popular devices used by ISPs, integrators, enterprise networks and home users alike. The advisory covers all of RouterOS < 7.24, including legacy v6 deployments that will not receive an equivalent fix. The flaw was reported to CISA by an anonymous researcher, and the agency notes that no targeted public exploitation has been reported to it so far — a reprieve that will not last.
The administration surface, not the routing engine
The crucial point of this advisory is the location of the flaw. It is not the routing core that is affected — not BGP, OSPF or MPLS — but the web administration service, the HTTP/HTTPS interface that serves as the configuration console. And that interface is precisely what many administrators leave reachable from the internet to manage their routers remotely.
This is a classic of campaigns targeting MikroTik. For years, automated scanners have hunted routers whose web console answers on port 80 or 443, and misconfigured devices number in the tens of thousands. CVE-2026-84411 raises the stakes: it is no longer a matter of guessing weak credentials, but of obtaining root with no authentication at all — on a device that carries the entire traffic of a site.
CISA’s recommendation follows the same logic as for ICS equipment: minimize network exposure, place devices behind a firewall and isolate them from the business network. But the most direct defense, from MikroTik, is simple to state and sometimes heavy to apply in production: move to 7.24 or later, or make the web interface unreachable from outside.
Update, then lock down access
Updating a MikroTik router is a one-command job, provided you have console access. For a v7 device, moving to the fixed branch looks like this:
# Check the current version, then move to the fixed branch (>= 7.24)
/system package update check-for-updates
/system package update installThe reboot that follows is unavoidable and must be scheduled: on an edge router, the cutover drops site connectivity for the duration of the reboot. For v6 fleets, migrating to v7 is not a simple package upgrade — it changes the configuration format and requires a dedicated cutover plan, which is why so many devices remain on v6 and thus exposed.
Updating alone is not enough. MikroTik notes in its advisory that the flaw only fires if the web interface is reachable by the attacker. Best practice is to disable the web service (www and www-ssl) on exposed interfaces, or restrict it to an allowed address list, and never expose the administration console directly to the internet again. In other words: patching closes the door, but not exposing the door at all remains the real defense.
Why so many routers stay exposed
The persistence of the v6 fleet is not a technical footnote — it is the heart of the risk. RouterOS v6 receives no equivalent fix, and migrating to v7 is not a simple package upgrade: the configuration format changes, some scripting or queueing features need rewriting, and the cutover must happen on an edge device without dropping the site’s connectivity. The result is that thousands of MikroTik routers still run v6, often with operators or integrators managing whole fleets with no migration budget.
That reality is worsened by the nature of the device itself. A MikroTik router is built for fine-grained administration — that is its strength — but that finesse invites leaving the web interface reachable “just in case”, sometimes on port 80, sometimes over self-signed HTTPS. Search engines like Shodan and Censys index these consoles by the tens of thousands, and campaigns targeting MikroTik barely have to search: they query those engines, check the version, and fire the exploit.
The operational lesson is simple to state. CVE-2026-84411 only fires if the web interface is reachable. An administrator who has disabled www and www-ssl on the public interface, or restricted access to a management address list, is out of reach even without patching. By contrast, a router exposing its console to the internet must be treated as already compromised until the update is applied — the flaw needs a single request, and whoever sends it first wins.
Verdict
If you run MikroTik routers on v7, schedule the move to 7.24 or later without delay — a CVSS 9.8 reachable without authentication leaves no room for triage, and the window between the public advisory and the first active exploitation is measured in days, not weeks. If your fleet still runs RouterOS v6, treat the migration to v7 as a full infrastructure project, and in the meantime cut web access to those devices from the internet immediately. And in every case, audit what remains exposed: a router whose administration interface answers from outside is a flaw waiting for its exploit, whatever the vendor.