CVE-2026-84411, scored CVSS 9.8, is an integer underflow in RouterOS’s web management service, reachable before authentication with a single crafted request that yields root code execution. Any MikroTik router whose web interface is reachable from the internet must move to 7.24 or pull that interface off the network.
On September 22, 2026, D-Link confirmed two critical flaws in the end-of-life DIR-822A router: a stack-based buffer overflow in the DHCP server (CVE-2026-86296, CVSS 10) and an out-of-bounds write in the L2TP parser (CVE-2026-86510, CVSS 9.9), both with public proof-of-concept code and no patch available. Replace or isolate these routers, and never expose them to the internet.
NEC fixes CVE-2026-16876, a critical missing-authentication flaw (CVSS 9.4) in the WebGUI of UNIVERGE IX-R and IX-V enterprise routers: a forged message bypasses login and runs arbitrary CLI commands. Apply the firmware update, or disable the WebGUI if it is reachable from the internet.
CERT Polska warns that attackers are taking full administrative control of MikroTik routers whose SSH service is reachable from the internet, without authentication. Update RouterOS and audit the configuration before putting any device back into service.
The US Justice Department and FBI announced the takedown of a network of SOHO routers compromised by Russia’s GRU, which was hijacking DNS lookups to intercept credentials and encrypted email. The lesson in one line: the home router has become the intelligence services’ preferred interception point, and it must be defended like an attack surface.
Two flaws published on August 19, 2026, CVE-2026-71960 and CVE-2026-71961, let an accountless attacker forge an MQTT token and then run root commands on the Cudy WR3000 mesh router. Update to firmware 2.5.24 and take the mesh interface off your internet exposure.
