CISA warns MikroTik RouterOS flaw rated 9.8 allows root code execution

October 1, 2026 at 07:12 PM1 min

This digest was compiled by AI from multiple sources — links to the originals are below.

A critical vulnerability in MikroTik RouterOS allows unauthenticated attackers to execute code as root via a single crafted HTTP request. CISA urges users to update to RouterOS 7.24.5 or the latest available version. More than 367,000 hosts expose the RouterOS web interface directly to the internet.

Key Facts

The flaw is rated 9.8 out of 10 on the CVSS scale and affects the web management service in RouterOS versions earlier than 7.24.
CISA advises users to update to RouterOS 7.24.5 or the latest available version.
Censys scans show more than 367,000 hosts expose the RouterOS web interface with the default page title "RouterOS router configuration page."
The vulnerability is tracked as CVE-2026-84411 and is separate from the MikroTrick exploit chain.

Vulnerability Details

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request. The flaw is rated 9.8 out of 10 on the CVSS security score. RouterOS versions earlier than 7.24 are affected, and users are advised to update to the latest version.

Exposure and Mitigation

According to Censys scans, more than 367,000 hosts expose the RouterOS web interface with its default page title "RouterOS router configuration page." Attackers can target them directly from the internet, though it is unclear how many of the IPs run vulnerable versions. CISA says sensitive services should sit behind firewalls, with secure remote access when needed. RouterOS updates are typically not installed automatically and require user action, which can leave many devices vulnerable.