CISA Warns of MikroTik RouterOS CVE-2026-84411 Root RCE: Upgrade to 7.24+

That means no password, no user click and no exploit chain. One request could give an attacker root on the device that routes the network's traffic.

What CISA published​

CISA disclosed the issue on September 29, 2026, in advisory ICSA-26-272-06. The flaw affects MikroTik RouterOS versions earlier than 7.24 and has a CVSS v3 severity score of 9.8. CISA's machine-readable CSAF record gives the full vector as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means an attacker needs only network access, the attack is simple, no privileges or user interaction are required, and the impact on confidentiality, integrity and availability is high. The same record classifies the bug as CWE-191, integer underflow (wraparound).

Other advisory details:

• Who reported it: An anonymous researcher reported the vulnerability to CISA.
• Sectors: CISA identifies communications and information technology as affected critical infrastructure sectors and notes that the vulnerable products are used worldwide.
• Exploitation status: At publication, CISA said it had received no reports of public exploitation specifically targeting CVE-2026-84411.

The exploitation statement is narrower than it sounds. It means CISA hasn't received any reports. It doesn't mean nobody is exploiting the bug. SecurityOnline's report on the advisory made the same point from another direction, noting that CERT Polska separately reports that attackers have exploited a different pair of RouterOS flaws, known as MikroTrick, since early September.

Section summary: CVE-2026-84411 is a 9.8-rated, pre-authentication root RCE in the RouterOS web-management service. It affects versions earlier than 7.24, and CISA says it has no reports of exploitation so far.

The version confusion, cleared up​

The main practical question is which RouterOS version fixes the bug, and early coverage got it muddled. BleepingComputer, which reported the story first, noted that CISA listed versions below 7.24 as affected but also relayed a vendor recommendation to update to version 7.23 or later. Those two statements contradict each other. BleepingComputer said that it had emailed both MikroTik and CISA for clarification about the RouterOS versions affected by CVE-2026-84411 and hadn't heard back at publication. Other outlets repeated the error. Privacy Needle, for example, wrote that MikroTik has released updates addressing the issue, recommending users upgrade to version 7.23 or later to mitigate the risk.

CISA's own record resolves it. The CSAF revision history shows an "Update A" dated September 30, 2026, described as fixing an upgrade-version typo. The corrected fix guidance says MikroTik recommends updating RouterOS to version 7.24 or later. The affected range is still RouterOS earlier than 7.24.

Use 7.24 as the minimum. Don't treat 7.23 as a safe target for this CVE.

MikroTik's stable changelog shows several builds in the 7.24 line:

This has an awkward consequence for the long-term channel. BleepingComputer reported that the newest long-term release is 7.23.7, available since September 16. Going only by CISA's stated range, that number is below 7.24. Neither MikroTik nor CISA has said whether the fix was backported into 7.23.x. BleepingComputer also reported that the vendor has yet to publish a security advisory about the issue. Until MikroTik says otherwise, admins on the long-term channel should assume they're in the affected range. They can move to the 7.24 stable line, or lock down web management hard while they wait for vendor clarification.

Section summary: CISA's corrected advisory sets the fix threshold at 7.24. Stable-channel users have builds up to 7.24.4. Long-term-channel users on 7.23.x have no vendor statement about backports yet.

Why a router bug matters to Windows shops​

The RouterOS web interface isn't a Windows product. But in many small businesses, branch offices, MSP-managed sites and home labs, the MikroTik box sits in front of the Windows fleet. It handles NAT, DHCP, DNS forwarding and VPN termination for every PC, domain controller and file server behind it.

Root on that device is a strong foothold. GBHackers, summarizing CISA's warning, said successful exploitation could lead to full device compromise, network pivoting, traffic interception, or persistent access to environments that rely on affected routers. An attacker holding the edge router could redirect DNS, watch unencrypted internal traffic or keep a hidden route back into the network. Endpoint tools on Windows machines won't see any of that.

On the bug itself: this type of flaw occurs when a software component performs arithmetic that produces a value below the minimum representable by its integer type. In a request-body parser, a length calculation that wraps around can produce a huge value. Memory-safety bugs of that kind can sometimes turn into code execution. That explanation comes from general industry knowledge. CISA hasn't published technical details beyond its summary.

What to do now​

CISA's advisory offers general control-system defensive practices rather than a RouterOS-specific walkthrough. Its main recommendations:

1. Keep control systems inaccessible from the internet.
2. Place control networks and remote devices behind firewalls, isolated from business networks.
3. Use updated VPNs for remote access and secure all connected devices.

The CSAF record also tells organizations to do impact analysis and risk assessment before deploying defensive measures. Anyone who sees suspected malicious activity should follow internal incident procedures and report findings to CISA.

Here's a practical order of work for RouterOS administrators, based on CISA's guidance and standard edge-device hygiene:

1. Inventory versions. Find every RouterOS device and record its version. Anything below 7.24 is in CISA's affected range.
2. Patch exposed devices first. SecurityOnline's advice is sensible: because this MikroTik RouterOS vulnerability needs no credentials, exposed routers should be patched first. MikroTik says devices normally offer upgrades through RouterOS's "Check for updates" menu.
3. Get web management off untrusted networks. Until you patch, keep the web management interface off the internet, and limit access to trusted IP ranges or a VPN. In RouterOS, the web services (WebFig over HTTP and HTTPS) are managed in the IP Services list, where you can disable them or restrict them to specific addresses. That's general platform knowledge, not an instruction from CISA. It reduces risk but doesn't replace patching.
4. Check firewall input rules. Make sure port forwards or permissive rules haven't left management services reachable from outside.
5. Check after upgrading. In its separate September security notice, MikroTik told users to inspect device configurations after upgrading for unknown scripts, users or settings they don't recognize. That advice was written for a different bug, but it's a reasonable step on any router that was exposed before the patch.

Section summary: Upgrade to 7.24 or later, starting with internet-facing devices. Restrict web management to trusted networks. Treat firewalling as a stopgap, not a fix.

Don't mix this up with MikroTrick​

September has been a rough month for RouterOS, and the advisories are easy to confuse. BleepingComputer noted that Poland's CERT recently warned that attackers had chained CVE-2026-67276 and CVE-2026-86060 to take full control of devices with SSH exposed to the internet. MikroTik's September 3 security notice covers that set of issues, known by the codename "MikroTrick" and CVE numbers CVE-2026-67276, CVE-2026-86060 and CVE-2026-67277, as originally reported by CERT.pl. It lists fixes in 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21.

That's a separate, SSH-focused problem. Nothing public connects the MikroTrick activity to CVE-2026-84411. The two cases share a lesson, though: management interfaces exposed to the internet on RouterOS devices keep causing trouble. MikroTik's own advice for MikroTrick was to use a VPN such as WireGuard for router access instead of opening management ports at all. That advice fits here too.

Bottom line​

Some are speculating that the bug will end up in CISA's Known Exploited Vulnerabilities catalog. A prediction-market site already has a question open on whether it appears there by October 31. That's guesswork, and there's no need to wait for it. The bug is pre-authentication, rated 9.8, and gives root with one request, on a platform attackers and botnet operators already target. The official remediation is clear now that CISA has corrected its typo: RouterOS 7.24 or later. Stable-channel devices can go to the current 7.24.x build. Long-term-channel devices need extra scrutiny until MikroTik publishes its own advisory. Any router with its web interface open to the internet should be fixed first.