CVE-2026-84411: RouterOS HTTP Service RCE Vulnerability

CVE-2026-84411 Overview

CVE-2026-84411 is a pre-authentication integer underflow vulnerability [CWE-191] in the web management service of affected MikroTik RouterOS versions. The flaw resides in HTTP request body handling and is reachable without any credentials. An unauthenticated network attacker can send a single crafted HTTP request to achieve arbitrary code execution as root or trigger a denial-of-service condition. The vulnerability is tracked under CISA ICS Advisory ICSA-26-272-06 and carries a CVSS 4.0 score of 9.3. RouterOS devices commonly serve as edge routers and firewalls, so successful exploitation grants attackers a privileged foothold at the network perimeter.

Critical Impact

Unauthenticated remote code execution as root on exposed RouterOS web management interfaces via a single crafted HTTP request.

Affected Products

• MikroTik RouterOS (versions enumerated in CISA advisory ICSA-26-272-06)
• RouterOS devices exposing the web management (www) service
• MikroTik network appliances running vulnerable RouterOS firmware

Discovery Timeline

• 2026-10-02 - CVE-2026-84411 published to the National Vulnerability Database (NVD)
• 2026-10-06 - Entry last modified in NVD
• 2026-10-08 - EPSS score recorded at 0.945%

Technical Details for CVE-2026-84411

Vulnerability Analysis

The vulnerability exists in the HTTP request body parser of the RouterOS web management service. The parser performs arithmetic on a size or length field derived from attacker-controlled HTTP input without validating that the operand remains within expected bounds. When the computation underflows, an unsigned integer wraps to a very large value, which then drives subsequent memory operations such as buffer allocation, copy length, or bounds checks.

Because the flaw is reachable before authentication, no credentials, tokens, or prior interaction are required. Exploitation can corrupt memory inside the web service process, which runs with root privileges on RouterOS. A successful attacker can transition memory corruption into arbitrary code execution, or alternatively crash the service to cause denial of service.

RouterOS devices sit at network boundaries, so compromise frequently exposes internal routing, VPN termination, firewall policy, and management credentials for downstream infrastructure.

Root Cause

The root cause is improper validation of a length or size value in HTTP request body handling, classified as an integer underflow [CWE-191]. Arithmetic on an unsigned length field produces a wrapped value that is subsequently trusted by memory operations.

Attack Vector

The attack vector is network based. An attacker sends a single crafted HTTP request to the RouterOS web management port, typically TCP 80 or 443. No authentication, user interaction, or chained vulnerability is required.

The vulnerability mechanism is described in the CISA advisory. See the CISA ICS Advisory ICSA-26-272-06 and the corresponding CSAF document for authoritative technical details.

Detection Methods for CVE-2026-84411

Indicators of Compromise

• Unexpected HTTP POST requests to RouterOS web management endpoints with malformed Content-Length headers or truncated bodies.
• Crashes, restarts, or watchdog events affecting the RouterOS www service process.
• New or modified RouterOS scripts, scheduler tasks, or user accounts created without a corresponding administrator action.
• Outbound connections from RouterOS devices to unfamiliar command-and-control infrastructure.

Detection Strategies

• Alert on inbound HTTP traffic to RouterOS web management ports from untrusted networks.
• Inspect HTTP request bodies for anomalous Content-Length values, including values of zero or near the 32-bit boundary.
• Correlate RouterOS service crash events with preceding HTTP requests from the same source address.
• Review RouterOS audit logs for configuration changes that follow unexplained management service restarts.

Monitoring Recommendations

• Centralize RouterOS logs via syslog into a SIEM for retention and correlation.
• Monitor exposure of RouterOS management interfaces to the public internet using external attack surface tooling.
• Baseline normal management traffic sources and alert on deviations.

How to Mitigate CVE-2026-84411

Immediate Actions Required

• Remove RouterOS web management (www and www-ssl) services from untrusted and internet-facing interfaces.
• Apply the fixed RouterOS firmware from the MikroTik Download Page as soon as a patched version is available for your branch.
• Restrict management access to a dedicated administrative subnet or VPN only.
• Audit RouterOS devices for signs of prior compromise, including unauthorized users, scripts, and scheduler entries.

Patch Information

MikroTik publishes fixed RouterOS firmware through the MikroTik Download Page. Administrators should identify the branch in use (stable, long-term, or testing) and upgrade to the version identified as fixed in CISA ICS Advisory ICSA-26-272-06. Reboot the device after the upgrade to ensure the patched web service is loaded.

Workarounds

• Disable the web management service entirely using /ip service disable www,www-ssl and manage the device over SSH or Winbox from a trusted network.
• Apply firewall rules on the input chain to drop HTTP and HTTPS management traffic from any address not on the administrative allowlist.
• Place RouterOS management interfaces behind a VPN concentrator so no HTTP port is reachable from the internet.

# Configuration example: restrict RouterOS web management access
/ip service disable www,www-ssl
/ip firewall filter add chain=input protocol=tcp dst-port=80,443 \
    src-address-list=!mgmt-allowlist action=drop comment="Block web mgmt"
/ip firewall address-list add list=mgmt-allowlist address=10.0.0.0/24