MikroTik RCE vulnerability in RouterOS allows pre-auth root execution

CISA has issued an alert about a critical pre-authentication remote code execution flaw in MikroTik RouterOS, tracked as CVE-2026-84411. According to the agency, a single crafted HTTP request against the RouterOS web-management service can produce integer underflow in the HTTP request body handling and allow arbitrary code execution as root or cause denial of service.

BleepingComputer reports the advisory and says MikroTik has not yet published a security advisory and did not respond to requests for clarification as of the story. The report also notes CISA has no evidence of active exploitation, but warns the risk is real because unauthenticated requests can trigger the bug.

What CISA reported about the flaw

CISA describes the issue as an integer underflow in RouterOS web-management HTTP request processing that is "reachable before authentication." The agency says that an unauthenticated network attacker who sends a single crafted request can either execute code as root or cause a denial of service. CISA issued the advisory to alert organizations and provide defensive measures, even though it says it is not aware of active exploitation.

BleepingComputer adds that it contacted MikroTik and CISA for clarification about exactly which RouterOS builds are affected, and that the vendor had not published a notice at the time of the report.

Which RouterOS versions are affected

CISA states that RouterOS versions below 7.24 are currently affected. The agency also reports that the vendor recommends users update to version 7.23 or later to mitigate the risk. BleepingComputer notes the latest stable and long-term releases are available, but also reports that MikroTik had not posted a public advisory as of publication.

If your environment uses RouterOS, treat the version guidance in the alert as urgent information to verify against your devices and patching policy.

Why this matters to small businesses, nonprofits, and public teams

• The bug is exploitable before authentication, meaning an internet-facing web-management interface can be attacked without valid credentials.
• CISA warns a single crafted request can yield root privileges, which makes impact high for any device used to route or manage networks.
• BleepingComputer reminds readers that MikroTik flaws are commonly targeted by attackers and botnets; the article cites a recent Poland CERT warning about an exploit chain that let attackers take full control of devices when SSH was exposed.

If you or your hosting provider expose router management or SSH to the internet, this alert merits immediate review.

MikroTik RCE vulnerability: practical steps to protect devices

CISA included recommended defensive actions in the advisory. At a minimum, review and apply these controls:

• Keep control systems inaccessible from the internet, remove public exposure of router web management where possible.
• Place control networks and remote devices behind firewalls and isolate them from business networks.
• Use updated VPNs for remote access and secure all connected devices that rely on those networks.
• Verify RouterOS versions on devices you manage, and follow vendor update guidance before applying changes in production.
• If you must allow remote management, restrict access by source IP and monitor for unusual requests or crashes.
• If you run devices with SSH exposed, review exposure and lock down access; related MikroTik flaws have been chained to seize devices when services are exposed.

Want to know how exposed your own site is? Start with a free external scan.

Communicate and follow up

• Notify your IT staff or service provider immediately if you have internet-facing RouterOS management interfaces, and ask them to confirm whether devices are on versions CISA identified as affected.
• If you host customer or partner systems on networks that use MikroTik devices, inform those stakeholders and document any mitigations you apply.
• Monitor vendor channels for an official MikroTik advisory; BleepingComputer reported that MikroTik had not published one as of the story and that follow-up questions were sent.

Keep monitoring and test your controls

CISA said it is not aware of active exploitation, but the combination of pre-auth reachability and root impact makes this a high-priority item. Follow the agency guidance above, check your device versions, and ensure remote management and VPNs are configured and monitored. For a quick starting point, use the free external scan to see what is visible from the internet and then plan remediation with your IT team.

For the BleepingComputer report on the alert and context, see the original article: https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-pre-auth-rce-flaw-in-mikrotik-routeros