CVE-2026-84411

criticalpriority · track · 10EPSS 0.009 · 61 %ileexploit · PoCDERUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · PoC

Likely / severe?

0.95% (61st) EPSS

CVSS 9.8 · critical

Is it mine?

3 products

Check your exposure

Who says so?

3 sources

fstec_bdu · cert_bund · cisa_csaf_ot

EPSS · scored 2026-10-22

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRouterOScisa_csaf_ot
MikroTik recommends users update RouterOS to version 7.24 or later. The upgrade can be downloaded from the MikroTik website.
https://mikrotik.com/download

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.9–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ics-cert@hq.dhs.gov USexploitability 3.9 · impact 5.9

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · ics-cert@hq.dhs.gov US

v4.08.9highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-191USCWE-191USCWE-191US

exploits (2)

Public proof-of-concept and weaponised exploit code.

Apiratchai/CVE-2026-84411-reproductionCVE-2026-84411 root cause notes and a non-destructive probe (RouterOS before 7.24)PoC · poc_in_github
maxprog-svg/CVE-2026-84411 CVE-2026-84411 — MikroTik RouterOS WebFig Integer Underflow ExploitPoC · poc_in_github

affected products (3)

Products and version ranges known to be affected.

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3661MikroTik RouterOS: Schwachstelle ermöglicht Codeausführung und DoSDeutsch2026-09-29csaf · cert_bundDE
Ein entfernter Angreifer kann eine Schwachstelle in MikroTik RouterOS ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial-of-Service-Zustand auszulösen.
ICSA-26-272-06MikroTik RouterOS2026-09-29icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service.

also known as (1)

Other names and identifiers for this entity.

BDU:2026-16178 fstec_bdu

sources

Which sources assert this record, and when.

fstec_bdu cert_bund cisa_csaf_ot NVD CVE.org MITRE

published 2026-10-02modified 2026-10-12

references (3) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan