CISA warns RouterOS flaw can give attackers root access with one request

CISA warned that a MikroTik RouterOS vulnerability can allow an unauthenticated attacker to execute code with root privileges or disrupt service using one crafted request, BleepingComputer reported. CVE-2026-84411 involves an integer underflow in the web-management service's handling of HTTP request bodies. CISA has no knowledge of active exploitation. Its version guidance is inconsistent: it identifies versions below 7.24 as affected but cites a vendor recommendation to update to 7.23 or later. BleepingComputer sought clarification from CISA and MikroTik. CISA also recommends keeping control systems off the internet and isolating them behind firewalls.