Intel

CVE-2026-84411

RouterOS: Integer Underflow (Wrap or Wraparound) (CVE-2026-84411)

criticalEPSS 1.0%

Description

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.

Source: cisa_ics_advisoryNVD (NIST)BSI WID Portalcvelistv5CVE.org (MITRE)BSI CSAF

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

MikroTikRouterOS
< 7.24fixed in 7.24

Metrics

XIEM Effective CVSS
9.8
Source: cna-v3
EPSS percentile
59.9 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
critical
Priority score
107.72
Exploit maturity
no public PoC known
CVSS v3
9.8
CVSS v4
9.3
EPSS score
1.0 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-10-02 23:16 UTC
CWE
CWE-191

Weakness classes (CWE)

  • CWE-191Base

    Integer Underflow (Wrap or Wraparound)

    The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-10-03 16:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-84411","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical…
  2. New CVE Received2026-10-02 23:16 UTC· ics-cert@hq.dhs.gov
    • Description: The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.
    • CVSS V4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    • CWE: CWE-191