CISA предупреждает о критической RCE-уязвимости в MikroTik RouterOS

CISA has issued a warning about a critical flaw, tracked as CVE-2026-84411, in MikroTik RouterOS that lets an attacker achieve remote code execution with root privileges or trigger a denial of service without needing to authenticate. A single crafted HTTP request sent to the device's web management interface is enough to exploit the bug, which stems from an integer underflow in how RouterOS parses incoming HTTP requests before the authentication stage. Rated 9.8 on the CVSS scale, the issue affects all RouterOS versions prior to 7.24; CISA initially pointed to version 7.23 as the fix but later corrected the advisory to specify 7.24 or later as the safe release. There are currently no reports of this flaw being used in actual attacks, but administrators are urged to keep management interfaces off the public internet, segment control networks from corporate ones with firewalls, and rely on up-to-date VPNs for remote access. This comes shortly after CERT Polska disclosed a separate set of RouterOS bugs, including the so-called MikroTrick chain (CVE-2026-67279 and CVE-2026-86060), which is already being actively exploited to fully take over devices with internet-exposed SSH.