A critical vulnerability in MikroTik RouterOS could allow unauthenticated remote attackers to execute arbitrary code with root privileges or trigger a denial-of-service condition on affected devices. Tracked as CVE-2026-84411, the flaw affects RouterOS versions earlier than 7.24 and carries a CVSS v3 score of 9.8.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) disclosed the issue on September 29, 2026, through Industrial Control Systems Advisory ICSA-26-272-06.
MikroTik routers are widely deployed across communications and information-technology environments worldwide, making the vulnerability particularly significant for organizations that expose management services or router interfaces to untrusted networks.
Critical MikroTik RouterOS Flaw
CVE-2026-84411 is classified as an integer underflow, also known as an integer wraparound vulnerability. Such flaws occur when software performs arithmetic on a value that falls below its minimum supported range, causing it to wrap to a large positive value or otherwise produce an unexpected result.
In RouterOS, an attacker could potentially exploit the vulnerable condition remotely without authenticating to the target device.
Successful exploitation could result in remote code execution as root, the highest privilege level on RouterOS, giving an attacker the ability to alter router configurations, establish persistence, intercept or redirect network traffic, deploy additional payloads, or use the device as a foothold for lateral movement.
CISA also warned that exploitation may result in denial of service. This could disrupt routing, remote administration, internet connectivity, or operational communications that rely on affected MikroTik infrastructure.
The advisory identifies communications and information technology as critical-infrastructure sectors with potential exposure.
Affected RouterOS Versions
The vulnerability affects MikroTik RouterOS releases earlier than version 7.24. Organizations running any RouterOS deployment below that version should treat the issue as urgent and identify exposed systems, including edge routers, branch-office appliances, wireless controllers, VPN gateways, and devices that support remote or industrial environments.
Administrators should upgrade affected systems to RouterOS 7.24 or a later supported release after conducting an appropriate compatibility and operational-impact review.
Organizations should also verify that backup configurations are available before making changes, particularly where routers support production networks or industrial control system connectivity.
At the time of publication, CISA said it was not aware of public exploitation specifically targeting CVE-2026-84411.
However, the combination of unauthenticated access, remote attack potential, root-level code execution, and the public disclosure of a critical flaw increases the likelihood that attackers will investigate vulnerable RouterOS devices.
CISA urged organizations to minimize network exposure for control-system devices and ensure they are not directly accessible from the public internet. Router management interfaces should sit behind firewalls and be segmented from corporate and operational technology networks.
Where remote administration is necessary, organizations should use secure remote-access methods such as properly maintained VPNs and enforce strong access controls.
Security teams should also restrict administrative services to trusted source addresses, disable unnecessary RouterOS services, monitor for unexpected configuration changes, review authentication and firewall logs, and assess internet-facing devices for compromise indicators.
An anonymous researcher reported the vulnerability to CISA. Organizations that identify suspected malicious activity should follow incident-response procedures and report relevant findings to CISA for correlation and tracking.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
