CISA warns of critical pre-authentication flaw in MikroTik RouterOS
A CISA advisory published on September 29, 2026 describes a flaw in the RouterOS web service that could enable remote code execution as root or denial of service. MikroTik recommends upgrading to version 7.23 or later.
Source: MikroTik RouterOS — falha pré-autenticação permite execução remota de código como root (cisa.gov). Text prepared with AI from this source.
What happened and what to do
In an advisory published on September 29, 2026, CISA reports CVE-2026-84411 in the MikroTik RouterOS web management service. An integer underflow in HTTP request handling can be exploited over the network, without authentication and with a single crafted request, to execute code as root or cause denial of service. The advisory rates the issue critical: CVSS 9.8 under version 3.1 and 9.3 under version 4.0. MikroTik recommends upgrading to RouterOS 7.23 or later.
Companies using RouterOS can inventory their devices, identify versions and exposure of the web service, and prioritize upgrades based on operational risk. They can also restrict internet access to management interfaces, segment control networks, and monitor access attempts and configuration changes. VPNs used for remote access should remain up to date, and devices connected through them also need protection.
How the consultancy can help
Wendelmaques can assess device exposure and operational risks, define a remediation scope, and implement inventory, monitoring, segmentation, and access controls. Ongoing operation can be included according to the environment’s needs.
Next step
Send a short description of your RouterOS environment and your upgrade or security needs to receive a scoped proposal.
Let's assess your project
I reply with scope and a proposal.