CVE-2026-84411: Pre-Auth Integer Underflow Threatens 367,000…

CISA published advisory ICSA-26-272-06 detailing a critical vulnerability in MikroTik RouterOS. A single crafted HTTP request allows unauthenticated remote code execution as root via an integer underflow in the web management service. Over 367,000 web interfaces are exposed online per Censys, against a backdrop of 2.8 million total MikroTik devices detected by Shadowserver Foundation. MikroTik has not issued a dedicated security advisory; CISA identifies RouterOS 7.24 as the fixed version, leaving the status of intermediate 7.23.x releases unclear.

{"main_topic":"cybersecurity","topics":["cve","vulnerability","rce","router","patch"]}

On September 29, 2026, CISA published advisory ICSA-26-272-06 for CVE-2026-84411, a critical vulnerability in the MikroTik RouterOS web management service. An integer underflow in HTTP request body handling allows an unauthenticated remote attacker to execute arbitrary code as root with a single crafted packet. The alarm stems from the convergence of three factors: technical severity, trivial exploitability, and an internet-exposed attack surface exceeding 367,000 web interfaces according to Censys data.

Key Takeaways

CVE-2026-84411 is classified as CWE-191 (integer underflow) in the RouterOS web management service, reachable pre-authentication per CISA.
CVSS v3.1 score is 9.8 (Critical); v4.0 score is 9.3 (Critical). Exploitation requires a single crafted HTTP request.
MikroTik has not published a dedicated security advisory for this CVE; the CISA advisory remains the sole official source.
Over 367,000 RouterOS web interfaces are exposed online per Censys, against a total of over 2.8 million MikroTik devices detected by Shadowserver Foundation.

The Flaw: How an Integer Underflow Opens Root

The issue resides in the HTTP request body size calculation within the RouterOS web management service. The affected components are WebFig/www on TCP/80 and www-ssl on TCP/443. CISA explicitly describes the condition: "The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication." This miscalculation — a subtraction that drives the value below the representable minimum — corrupts subsequent memory handling.

The impact is maximal: the unauthenticated attacker achieves code execution as root or can cause denial of service. The operational simplicity is striking: a single crafted packet. No exploit chain, no authentication, no user interaction required. The attack vector is AV:N/AC:L/PR:N/UI:N in CVSS v3.1: network, low complexity, no privileges required, no user interaction.

Version Confusion: CISA Says 7.24, But What About 7.23.x?

CISA and the National Vulnerability Database list 7.24 as the fixed version. However, a 7.23.x branch with later releases (7.23.4, 7.23.7) has been distributed in MikroTik's stable channel. The record does not clarify whether these intermediate builds contain the backported fix for CVE-2026-84411. SecNews and BleepingComputer flag this discrepancy: some aggregators initially indicated 7.23 as sufficient, but CISA subsequently specified 7.24.

This ambiguity is not marginal for critical infrastructure operators. RouterOS lacks automatic updates; every patch requires manual administrator intervention. If an operator updated to 7.23.7 believing they were protected, but that build lacks the fix, the device remains vulnerable. MikroTik has not published a dedicated security advisory for this CVE; the vendor's official documentation does not mention CVE-2026-84411 as of the CISA advisory's publication.

Immediate Actions

Verify the installed version: only RouterOS 7.24 or later are identified as fixed by CISA. Do not assume intermediate 7.23.x builds contain the fix.
Limit internet exposure of the web management service: disable WebFig/www and www-ssl on public interfaces, or restrict access via firewall to known administrative IP addresses.
Monitor logs for anomalous HTTP requests to management interfaces: requests with inconsistent body sizes or suspicious patterns targeting WebFig endpoints.
Check for official MikroTik patches specific to CVE-2026-84411, given the vendor has not yet published a dedicated advisory.

The Attack Surface: Numbers That Admit No Qualifiers

CyberNews, citing Censys data, reports over 367,000 hosts exposing the RouterOS web interface online. Shadowserver Foundation detects over 2.8 million total exposed MikroTik devices. These figures are not overlapping: the 367,000 represent hosts with reachable WebFig service; the 2.8 million represent total MikroTik devices with any exposed service.

Neither scan verifies the actual software version running. The count does not indicate how many are vulnerable; it indicates how many could be if unpatched. It remains an exceptionally broad attack surface for a pre-authentication vulnerability exploitable with a single packet.

"The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request." — CISA advisory ICSA-26-272-06

MikroTik's Silence and the Compliance Risk

The institutional context matters. CISA received the report from an anonymous researcher and published the advisory independently. MikroTik has not issued its own security communication. This pattern is not new for the Latvian vendor, but for this specific critical vulnerability it creates a regulatory vacuum: critical infrastructure operators subject to frameworks (NIS2, RFIE, CIR) require formal vendor documentation to attest patch status.

The EPSS (Exploit Prediction Scoring System) estimates a 0.95% probability of exploitation within 30 days per Strix.ai. CISA states that "no known public exploitation specifically targeting this vulnerability has been reported to CISA at this time." These two indicators — low EPSS and no known exploitation — offer no structural comfort: the vulnerability is technically trivial to exploit, the surface is immense, and independent researchers may have already developed undisclosed proof-of-concept code.

The editorial assessment is that MikroTik faces a disclosure governance problem. When a government advisory becomes the sole canonical source for a critical vulnerability in its own product, trust with the installed base erodes. Administrators are forced to operate on inference, not vendor certainty.

Frequently Asked Questions

Is RouterOS 7.23.7 safe?: The record does not confirm it. CISA explicitly identifies 7.24 as the fixed version. MikroTik has not clarified whether intermediate 7.23.x builds contain the backported fix.
Why did CISA, not MikroTik, publish the advisory?: CISA received the report from an anonymous researcher and coordinated disclosure. As of publication, MikroTik has not published a dedicated advisory for CVE-2026-84411.
Is the Winbox service affected?: The brief does not document a vulnerability in the Winbox service. CISA describes only the web management service (WebFig/www and www-ssl).

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter