MikroTik RouterOS critical flaw CVE-2026-84411 allows unauthenticated root code execution: update to 7.24

MikroTik RouterOS critical flaw CVE-2026-84411 allows unauthenticated root code execution: update to 7.24

1 October 2026: MikroTik routers and switches running RouterOS before version 7.24 have a critical vulnerability, CVE-2026-84411. Italy's national cybersecurity agency (ACN), through CSIRT Italia, published an alert on 1 October 2026. It says the flaw could let an unauthenticated remote attacker run arbitrary code with root privileges, or make the device unavailable. CSIRT Italia rates its systemic impact as high and recommends updating in line with the vendor's guidance. The US CISA advisory it cites, ICSA-26-272-06 of 29 September, rates the flaw 9.8, describes an integer underflow in the web management service that can be reached before login, and says "MikroTik recommends users update RouterOS to version 7.24 or later"; it reports no known exploitation.

Not yet independently verified. MikroTik's own page of 6 October 2026 confirms the critical rating and the fixed versions but does not say whether the flaw has been exploited. CISA reported no known exploitation on 29 September, and we could not confirm a report that it has since been listed as exploited. We will update this when it can be confirmed, and remove this note.

What is affected

• Product: MikroTik RouterOS, the operating system of MikroTik's routers, switches and wireless equipment.
• Versions: all before 7.24 (v7 stable), before 7.23.8 (v7 long-term) and before 6.49.23 (v6). Fixed releases are 7.24, 7.23.8 and 6.49.23, per MikroTik's own page of 6 October.
• Impact: remote code execution as root, or denial of service, without authentication.
• Exploitation: none reported by CSIRT Italia, which lists no proof-of-concept and no exploitation.

Why it matters

MikroTik equipment is cheap, capable and everywhere: small offices, branch sites, internet service providers, hotels and industrial sites. It has been a favourite target for botnets for years, because many devices sit directly on the internet with their management services exposed and are rarely updated. We wrote about a different RouterOS flaw, CVE-2026-67279, on 26 September. An unauthenticated root-level flaw is the kind that gets weaponised quickly once details are public.

What to do

• Until you can update, restrict or disable the www and www-ssl services, as MikroTik advises; its default firewall rules already block the web interface from the internet.
• Update RouterOS to 7.24 or later (or 7.23.8 long-term, or 6.49.23 on v6) on every MikroTik device, including the ones nobody remembers: branch routers, test units and devices managed by a provider.
• Close management access from the internet: Winbox, the web interface, SSH and the API should be reachable only from trusted networks or a VPN.
• Check for unexpected changes to users, scripts, scheduled tasks and firewall rules on devices that were exposed.
• Ask your internet or managed-network provider whether customer-premises MikroTik equipment has been updated.

Sources

• Agenzia per la cybersicurezza nazionale (CSIRT Italia): Risolta vulnerabilità in MikroTik RouterOS (AL06/261001/CSIRT-ITA) - 1 October 2026
• CISA ICS advisory ICSA-26-272-06: MikroTik RouterOS (read 2 October 2026) - 29 September 2026
• MikroTik: CVE-2026-84411 - 6 October 2026