MikroTik Pre-Auth RCE: Patch RouterOS to 7.24

MikroTik Pre-Auth RCE: Patch RouterOS to 7.24

On September 29, CISA published an advisory for a critical flaw in MikroTik RouterOS that needs no login, no user interaction and one HTTP request to hand an attacker root. It is the sort of bug that usually gets a CVE, a public disclosure and a scramble. What makes this one worth reading closely is that the version arithmetic does not add up — and the way it fails to add up lands precisely on the people who already did the responsible thing last month.

What the flaw actually is

CVE-2026-84411 is an integer underflow in the HTTP request body handling of the web management service, reachable before authentication. CISA's description is short enough to quote in full:

"The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request."

It scores 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 under CVSS 4.0, classified as CWE-191, Integer Underflow. The vector string is where the severity comes from: network reachable, no privileges, no user interaction, full confidentiality, integrity and availability impact. Root, from one packet, on a device that routers sit upstream of everything else you own.

Two details in the advisory are worth more attention than the score.

The first is provenance. "An anonymous researcher reported this vulnerability to CISA." Not to MikroTik. The disclosure path bypassed the vendor entirely, and as of BleepingComputer's September 30 report the vendor had still not published a security advisory of its own, having not responded to the outlet's request for clarification.

The second is the exploitation status: "No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time." So this is a pre-auth root RCE with a CVSS of 9.8 and no public exploit yet. That is a very good reason to patch this week rather than a comfortable one to patch eventually.

The version maths is the story

Here is the contradiction, stated plainly. CISA's affected-products entry lists MikroTik RouterOS: <7.24. CISA's remediation line says to update to "version 7.24 or later." But the same advisory, as BleepingComputer reports it, also carries the vendor's recommendation to update to "version 7.23 or later." Those two statements cannot both be right, because 7.23 is inside the range the advisory calls affected.

As of that report the current releases were 7.24.4 stable and 7.23.7 long-term, both out since September 16, and neither CISA nor MikroTik had answered questions about the discrepancy. If you are the kind of operator who reads an affected range and stops at the first version that sounds safe, you are about to make a mistake.

If you patched last month, you may still be exposed

Because the other MikroTik advisory from September 2026 is the one that actually has attackers in it. CERT Polska named an actively exploited chain "MikroTrick", built from two SSH bugs: CVE-2026-67276, an authentication bypass caused by incomplete validation of RSA public keys, and CVE-2026-86060, a privilege escalation triggered by specially crafted usernames. Chain them and you have full administrative control of a router without ever holding a private key.

MikroTik shipped fixes in 7.25beta3, 7.24.2, 7.23.4 and 6.49.21 on September 3, and CERT Polska validated them. Every operator with internet-exposed SSH should have taken that update — it was the urgent one.

Now look at the branch names. The long-term channel is 7.23, and its current point release is 7.23.7. Under CISA's stated affected range for CVE-2026-84411, 7.23.7 is below 7.24. So a network that upgraded the long-term branch correctly, in September, to close an actively exploited SSH chain, is sitting on a version that a pre-auth web-management underflow says is still vulnerable.

branch        current    CVE-2026-67276 / 86060   CVE-2026-84411
                                                            (CISA: <7.24)
------------  ---------  ------------------------  ---------------
stable        7.24.4     fixed 7.24.2             above range
long-term     7.23.7     fixed 7.23.4             inside range
6.x           6.49.21    fixed 6.49.21            below range

The feature branch is the only line where the September 3 fix and the September 29 fix point the same direction. That is a table, not a scare number, and it is the single most useful thing in either advisory. Take the uncertainty seriously, though: with the vendor silent and the affected range self-contradictory, "inside range" is the reading to plan around.

Plan for the possibility that you are already owned

CISA's advisory covers one CVE. It does not retroactively tell you whether MikroTrick reached you. CERT Polska's guidance on that is the part to keep.

It gives indicators. Log entries reading login failure for user -2 from <ip> via ssh and user <name> added by ssh:-2@<ip>. A highly privileged ops account that you did not create. And two addresses: 82.192.72.4, linked to confirmed successful attacks, and 103.102.31.18, observed attempting MikroTrick. For scale, ShadowServer Foundation data put the number of MikroTik devices with internet-exposed SSH at 122,500 as of September 5.

It also flags a limit on your own new tooling. The September 3 updates added a compromise-detection mechanism that checks for known signs of unauthorised configuration change at startup, disables malicious entries and logs a critical warning — and CERT Polska's warning is that the absence of a marker is no guarantee a router is clean. A clean startup banner is not an acquittal.

If compromise is suspected, the recommended path is not a patch. Isolate the device, preserve logs and configuration, factory-reset it, rebuild from a trusted configuration, and rotate passwords, keys and other secrets — because anything the router could reach is now in someone else's hands. Our note on patching before you preserve evidence covers the same tension from the other direction.

What to do

1. Move to the stable 7.24 branch, and take the latest point release. That is 7.24.4 as of September 16. It is the only line where both September advisories point the same way.
2. Stop trusting the long-term channel as equivalent. If policy requires long-term support, treat 7.23.x as carrying an open pre-auth RCE until MikroTik or CISA says otherwise in writing.
3. Shrink the web management surface now, not after you patch. CISA's guidance is to keep management interfaces off the internet entirely, behind firewalls, isolated from business networks, with VPN used for remote access and kept current. CERT Polska advises restricting or disabling externally reachable SSH, WWW/WWW-SSL and bandwidth-test services for operators who cannot update immediately.
4. Hunt before you patch. Grep your logs for the -2 SSH entries and the ops account, and check both addresses. You cannot do this after a factory-reset.
5. Rotate secrets on anything the device could touch. Not because the underflow stole them — nobody knows yet — but because a router that was reachable, unpatched and internet-facing is a router you should assume was read.

If you want the shape of this failure class rather than one instance, our pillar on pre-auth and exploited RCE covers what a 9.8 with no login actually buys an attacker. And when the unpatched device was holding personal data, the obligations that follow are not optional — that is the PDPA question the rotation step is really answering.

Sources

• CISA ICS Advisories: ICSA-26-272-06: MikroTik RouterOS
• BleepingComputer: CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS
• BleepingComputer (carrying CERT Polska reporting): Hackers exploit new MikroTik RouterOS flaws to hijack routers