CVE-2026-84411
CRITICAL 9.3The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.
Severe if exploited (CVSS 9.3), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.9%chance of exploitation in 30 days · 58th percentile
Impact if exploited
9.3CVSS 4.0 · CRITICAL
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-191: Integer Underflow (Wrap or Wraparound)
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References and research data (JSON)
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
2 candidates
- https://github.com/maxprog-svg/CVE-2026-84411
CVE-2026-84411 — MikroTik RouterOS WebFig Integer Underflow Exploit
PoC-in-GitHub · CVE-2026-84411
PoC-in-GitHub · CVE-2026-84411 · Updated 2026-10-11T20:39:45Z - https://github.com/Apiratchai/CVE-2026-84411-reproduction
CVE-2026-84411 root cause notes and a non-destructive probe (RouterOS before 7.24)
PoC-in-GitHub · CVE-2026-84411
PoC-in-GitHub · CVE-2026-84411 · Updated 2026-10-19T09:40:33Z
All CVSS metrics
- CRITICAL 9.8 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CRITICAL 9.3 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CRITICAL 9.3 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CRITICAL 9.8 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91836 EUVD · EUVD-2026-91836
Technical & other
- https://mikrotik.com/downloadCVE record · icscert · Updated 2026-10-02T22:09:48.298Z
NVD · CVE-2026-84411 · Updated 2026-10-06T15:15:48.310 - https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06CVE record · icscert · Updated 2026-10-02T22:09:48.298Z
NVD · CVE-2026-84411 · Updated 2026-10-06T15:15:48.310 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-06.jsonCVE record · icscert · Updated 2026-10-02T22:09:48.298Z
NVD · CVE-2026-84411 · Updated 2026-10-06T15:15:48.310