CISA warns that CVE-2026-84411, a flaw in MikroTik RouterOS web management, may let an unauthenticated network attacker execute code as root or cause a denial of service with one crafted request. The advisory’s affected-version boundary is not yet clear: CISA’s copy lists versions below 7.24, while a September 30 report attributed update guidance of 7.23 or later to MikroTik. Administrators should limit web-management exposure and verify current vendor guidance before selecting an update.
What CVE-2026-84411 does
CISA advisory ICSA-26-272-06, released September 29 and revised September 30, 2026, describes an integer underflow in RouterOS web-management handling of HTTP request bodies. The vulnerable code is reachable before authentication. CISA says a single crafted request could allow an unauthenticated network attacker to execute arbitrary code as root or cause a denial of service. Read the advisory copy.
As an Amazon Associate I earn from qualifying purchases.
“Pre-authentication” means an attacker would not first need valid RouterOS credentials, but still needs network access to the vulnerable web-management service. Restricting who can reach that service is therefore an immediate exposure-reduction measure, not a substitute for installing a confirmed security fix.
Which RouterOS versions are affected?
The version guidance reported on September 30, 2026 is inconsistent. CISA’s advisory copy lists MikroTik RouterOS versions below 7.24 as affected. BleepingComputer reported that MikroTik recommended updating to 7.23 or later, but also said the vendor had not published its own advisory and the affected-version detail needed clarification. Since the reported recommendation overlaps CISA’s listed range, neither statement establishes a confirmed fixed release on its own. Read BleepingComputer’s report.
#1 Best Overall
- hEX also known as RB750Gr3 is a five port Gigabit Ethernet router for locations where wireless connectivity is not required
- The device has a full size USB port. This new updated revision of the hEX brings several improvements in performance
- It is affordable, small and easy to use, but at the same time comes with a very powerful dual core 880MHz CPU and 256MB RAM
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude
- Dimensions: 113x89x28mm; Storage size: 16 MB; Passive PoE (PoE in); PCB temperature monitor, Voltage monitor and Mode button
As of that report, RouterOS 7.24.4 was the latest stable release and 7.23.7 the latest long-term release; both had been available since September 16. These are date-specific release details, not confirmation that either version fixes CVE-2026-84411.
Inventory each deployed device’s RouterOS version, then check MikroTik’s current official security notices and CISA’s advisory for a clarified affected range and fixed build before deciding what to install. Do not assume that a release number alone resolves the uncertainty.
Rank #2
- Wired Gigabit Router – 5x Gigabit Ethernet ports, 2.5G SFP, PoE-Out, USB, powered by RouterOS
What administrators should do now
- Identify exposed devices. Record RouterOS versions and determine which devices have web management reachable from the internet or other untrusted networks.
- Restrict web-management access. Remove public exposure where possible and allow access only from trusted administrative networks. Apply firewall controls to limit access to the management service.
- Isolate control equipment. Keep control systems off the public internet and separate control networks and remote devices from business networks behind firewalls.
- Secure remote administration. Use an updated VPN for remote access, and secure connected devices. These controls reduce exposure but do not replace a software update.
- Apply a verified update. Follow current MikroTik guidance for the affected device and branch; confirm the build is identified as fixing CVE-2026-84411 rather than relying on the ambiguous 7.23-or-later wording.
BleepingComputer reported CISA had no knowledge of exploitation of this specific vulnerability at the time of publication. That is not evidence that the flaw cannot be exploited, and reports of attacks using other MikroTik vulnerabilities should not be mistaken for confirmation of exploitation of CVE-2026-84411.
Recommended Free Tools
Keep separate MikroTik security notices in context
MikroTik’s September 16 notice for CVE-2026-52346 recommends keeping RouterOS up to date and using a strong firewall. That notice concerns a different vulnerability; its version guidance does not establish a fix for CVE-2026-84411. Read MikroTik’s CVE-2026-52346 notice.
Quick Recap
Best Value
- W128339515
Rank #4
- MikroTik RouterBOARD C52iG-5HaxD2HaxD-TC-US (US Version) hAP ax (WiFi6) Quad-Core IPQ-6010 864 MHz, RAM 1GB, RouterOS, License level 4 It's time to supercharge your home network with the Generation
- hAP ax has everything you might need in a primary home access point - and more
- Forget endless reviews and comparisons - this is the perfect device for 99% of homes
- Wireless signal is now stronger than ever
- Here are the two main ingredients of hAP ax's success: a state-of-the-art dual-band, dual-chain 4-4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
