A critical vulnerability in MikroTik's RouterOS lets an unauthenticated attacker take full control of a router by sending it a single crafted web request, according to an advisory from the U.S. Cybersecurity and Infrastructure Security Agency, BleepingComputer reported Wednesday. The flaw, tracked as CVE-2026-84411, affects RouterOS versions before 7.24, and no exploitation has been publicly reported so far.

What Happened

CISA published the issue on Sept. 29 as industrial control systems advisory ICSA-26-272-06. The bug is an integer underflow in the way the RouterOS web-management service processes HTTP request bodies, and it can be triggered before any login. CISA says a successful attack yields arbitrary code execution with root privileges or, alternatively, a denial of service.

The agency scores the flaw 9.8 under CVSS version 3.1 and 9.3 under version 4.0, both in the critical range. It credits an anonymous researcher with reporting the issue and lists communications and information technology as the affected sectors. MikroTik is based in Latvia.

RelatedCISA Orders Agencies to Fix Exploited Palo Alto Firewall and Cisco Email Gateway Flaws by Saturday

CISA's remediation is to update to RouterOS 7.24 or later. BleepingComputer noted that the current stable release is 7.24.4 and the newest long-term release is 7.23.7, which came out on Sept. 16; administrators who stay on the long-term branch should check MikroTik's release notes to confirm the fix is included.

Why It Matters

The combination of traits is what makes this bug serious. It needs no credentials, it lands with root access rather than a limited account, and it takes one request rather than a chain of steps. Any RouterOS device whose web interface is reachable from an untrusted network, including the open internet, is exposed.

MikroTik hardware is common in small and midsize businesses, at internet service providers and at remote industrial sites, and it has long been favored by botnet operators. BleepingComputer pointed to recent attacks, documented by Poland's CERT, in which two other RouterOS flaws, CVE-2026-67276 and CVE-2026-86060, were used to hijack routers with exposed SSH services. A compromised router can be used to relay traffic, launch denial-of-service attacks or watch traffic on the network behind it.

Context

Patched router firmware gives attackers a map. Once fixed and unfixed builds are both public, comparing them can show where the vulnerable code sits, which has historically shortened the time between a patch and working exploits for network edge devices. Many MikroTik deployments are rarely updated, especially in branch offices and unattended locations, so older builds tend to stay online long after a fix ships.

CISA's general guidance in the advisory applies directly: keep control-system devices off the internet, place them behind firewalls and separate them from business networks, and use up-to-date VPNs when remote access is needed.

What to Watch

The near-term signs to look for are public proof-of-concept code and internet-wide scanning for RouterOS web interfaces, either of which would raise the urgency sharply. Until devices are on 7.24 or later, administrators can reduce exposure by restricting the web-management service to trusted addresses or disabling it on interfaces that face the internet.