# Critical MikroTik RouterOS Integer Underflow Vulnerability (CVE-2026-84411) Enables Unauthenticated Remote Code Execution

> CVE-2026-84411 is an integer underflow (CWE-191) in the MikroTik RouterOS web management service, affecting versions earlier than 7.24 and rated CVSS 9.8 Critical. A single crafted unauthenticated request can yield root code execution or denial of service. CISA (ICSA-26-272-06) reported no public exploitation at disclosure.

- **Published:** 2026-09-30T00:00:00Z
- **Last reviewed:** 2026-09-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2805
- **ID:** TL-2026-2805
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-84411

## Description

CVE-2026-84411 is an integer underflow (wraparound, CWE-191) in the HTTP request body handling of the MikroTik RouterOS web management service. CISA advisory ICSA-26-272-06, released 2026-09-29 and covered by GBHackers on 2026-09-30, states the flaw is reachable before authentication over the network, so an unauthenticated remote attacker can send a single crafted request to execute arbitrary code as root or crash the service (denial of service). The CVSS v3.1 base score is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and the CVSS v4.0 score is 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). The vulnerability was reported to CISA by an anonymous researcher.

Impact per the sources: full device compromise, network pivoting, traffic interception, or persistent access on the router. Because RouterOS devices sit at the network edge and often expose management services to the internet, a compromised router gives an attacker a position to observe or redirect traffic for downstream networks. Affected sectors named by CISA are Communications and Information Technology.

Exploitation status: CISA stated it had received no reports of public exploitation specifically targeting CVE-2026-84411 at publication, no public PoC, threat actor, malware family, or network IOC is documented in the available sources. GBHackers notes that internet-facing network appliances are routinely scanned after vulnerability disclosures, so opportunistic scanning of exposed RouterOS web services should be expected.

Version caveat (unresolved in sources): the affected range is stated as RouterOS earlier than 7.24, but the CISA advisory remediation text says to update to RouterOS 7.23 or later, while the GBHackers article says 7.24 or later. At the time of research the MikroTik changelog page listed 7.23.7 (2026-09-16) as the newest release and no 7.24 entry or CVE-2026-84411 changelog line was visible, and NVD returned no record for the CVE yet. Defenders should confirm the fixed build against the MikroTik download/changelog pages and default to the latest available release.

Defensive priorities: identify all RouterOS devices, remove or restrict internet exposure of the web management service (HTTP/HTTPS), upgrade to the fixed release, review router logs for anomalous or malformed requests to the web service and unexpected configuration or account changes, preserve logs, and report suspicious activity to CISA.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1040 Network Sniffing
- T1557 Adversary-in-the-Middle
- T1499.004 Application or System Exploitation

## Sources

- [Critical MikroTik RouterOS Vulnerability Exposes Devices to Remote Code Execution](https://gbhackers.com/critical-mikrotik-routeros-vulnerability/)
- [CISA ICS Advisory ICSA-26-272-06 - MikroTik RouterOS](https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06)
- [MikroTik RouterOS changelogs](https://mikrotik.com/download/changelogs)
- [MikroTik RouterOS downloads](https://mikrotik.com/download)
- [CVE Record CVE-2026-84411](https://www.cve.org/CVERecord?id=CVE-2026-84411)
- [NVD API - CVE-2026-84411 (no record at time of research)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-84411)
- [MikroTik RouterOS CRA Class I after CISA July 2026 WireGuard advisory (related prior MikroTik advisories)](https://www.cyberresilienceact.eu/news/mikrotik-routeros-cra-class-i-after-cisa-july-2026-wireguard-advisory.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2805