CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS

CISA has issued an alert about a severe flaw in MikroTik RouterOS, tracked as CVE-2026-84411, that lets an attacker send a single malicious request to the device's web-management interface without needing to log in. The bug is an integer underflow in how RouterOS parses HTTP request bodies, and it can be abused to run arbitrary code with root privileges or to knock the device offline. CISA says versions prior to 7.24 are impacted, though the vendor's guidance points to updating to 7.23 or newer; the current stable release is 7.24.4 and the latest long-term build is 7.23.7. There's no confirmed exploitation yet, but MikroTik devices are a frequent target for botnets and attackers, including a recent campaign chaining separate RouterOS flaws (CVE-2026-67276 and CVE-2026-86060) to seize routers exposing SSH to the internet.