Our takeCISA warns of a critical pre-auth RCE in MikroTik RouterOS <7.24 (CVE-2026-84411). Update to 7.24 or later if you run it yourself.Cyber Resilience desk
What this means for you — Security leader:CISA reports active exploitation of CVE-2026-84411 (pre-auth integer underflow) in MikroTik RouterOS <7.24 that leads to RCE or DoS. Update immediately to 7.24 or later and audit all edge MikroTik devices.
What this means for you — Lean IT orgs:If you run a MikroTik router, update its RouterOS to version 7.24 or newer right away. This flaw lets attackers take it over with no login.
What this means for you — MSP:Audit every client MikroTik RouterOS device; versions below 7.24 are under active exploitation per CISA (CVE-2026-84411, pre-auth RCE/DoS). Patch to 7.24+ or replace.
What this means for you — Researcher:CISA advisory ICSA-26-272-06 details active exploitation of an integer underflow (CVE-2026-84411) in MikroTik RouterOS <7.24 enabling pre-auth RCE or DoS.