CVE-2026-84411

MikroTik RouterOS Integer Underflow

CRITICAL 9.3EPSS 0.9%

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.

Affected: MikroTik · RouterOS
CVSS v4.0 HQ: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 HQ: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.95% chance of exploitation in the next 30 days, 60th percentile
Published: 2026-10-02
Updated: 2026-10-03

Proof-of-concept exploits (2)

maxprog-svg/CVE-2026-844110★ · 2026-10-10
Apiratchai/CVE-2026-84411-reproduction0★ · 2026-10-13

References

CVE Record
NVD entry

CVE-2026-84411

Proof-of-concept exploits (2)

References

Related