One web request can run code on some MikroTik routers, CISA says

A router's web management page exists so administrators can log in. CISA now says that on MikroTik RouterOS, an attacker may not need to log in at all. The flaw sits in the part of the system that answers before anyone has proved who they are.

What CISA found

The US Cybersecurity and Infrastructure Security Agency (CISA) published an advisory on the RouterOS web management service. It describes an integer underflow in how the service handles the body of an HTTP request. An attacker can reach the flaw before authentication.

An unauthenticated attacker on the network could send one crafted request. That request could run arbitrary code as root, the highest privilege level on the device. It could also cause a denial of service.

BleepingComputer reports that the flaw is tracked as CVE-2026-84411. CISA says an anonymous researcher reported it. CISA also says no public exploitation of this flaw has been reported to it.

How the flaw works

Software often uses such a number to track how much data it has received. If the number is wrong, the program can misjudge sizes. That is the general pattern. The advisory does not describe the exact steps used against RouterOS.

The order of events is the key detail. The flaw is reached before authentication. The login check never gets a chance to stop the request. Password strength does not help here.

CISA's advisory says 7.24; one report says 7.23

CISA's advisory is direct. MikroTik recommends updating RouterOS to version 7.24 or later. BleepingComputer's account differs. It says CISA lists versions below 7.24 as affected. It then says the vendor advises 7.23 or later.

The two accounts have not been reconciled. The 7.23 wording appears only in BleepingComputer's paraphrase, and the source of that wording is unclear. The outlet emailed MikroTik and CISA for clarification. It had no reply when it published. It also says MikroTik had not yet issued its own advisory.

CISA's text names 7.24 or later as the fix. BleepingComputer's affected list covers versions below 7.24. Both place 7.23.7 below the fix. Only BleepingComputer's 7.23 recommendation would treat it as fixed, and the outlet could not get that confirmed. Teams on 7.23.x should confirm with MikroTik before treating those devices as fixed.

The lesson: a patch instruction must be checkable

This is WebPulse's view, not the report's. Patching starts with a clear instruction: update to this version. Here the primary text is clear. A secondary report adds doubt. That can stall a change ticket or send a team to the wrong version. A sound habit is to cite the primary advisory in the ticket. Then ask the vendor to settle any conflict.

Some context helps, though it does not prove a pattern. BleepingComputer says attackers and botnet malware often target MikroTik flaws. It points to a recent warning from Poland's CERT. The agency reported attackers taking full control of routers by chaining two other RouterOS flaws, CVE-2026-67276 and CVE-2026-86060. Those devices had SSH, a remote login service, open to the internet. That case involves different flaws. It does not show that anyone is using CVE-2026-84411.

What leaders should ask their teams

The advisory's exposure guidance is general advice for industrial control system devices. BleepingComputer presents it as recommendations to MikroTik router owners, and it applies sensibly here. CISA says to keep such devices unreachable from the internet. It also says to separate them from business networks with firewalls. Where remote access is needed, it points to VPNs, kept up to date. CISA adds that a VPN is only as secure as the devices connected to it.

Four questions turn that into action:

1. Do we know every device running RouterOS, including at branch sites and partners? 2. Can the web management interface be reached from the internet or from broad internal networks? 3. Which version is each device on? Has anyone confirmed with MikroTik that this version is fixed, especially anything on 7.23.x? 4. If we see suspicious activity, who reports it to CISA, and who isolates the device?

CISA also asks organisations to run an impact analysis before deploying defensive changes. A router update can interrupt service, so plan the window.

A login page protects a network only if the code in front of it holds. This advisory is a prompt to check the part of the router that answers first.

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CISA (Cybersecurity and Infrastructure Security Agency).