Vulnerabilities
Critical MikroTik RouterOS Flaw Could Let Attackers Take Control of Devices
A serious vulnerability in MikroTik RouterOS could allow attackers to run code or disrupt services. CISA urges users to update and secure their devices.
Ross GrantUpdated 3 min read
The short version
A serious bug has been found in MikroTik routers that could let hackers take control or shut them down. The problem affects many devices worldwide. Users should update their routers and limit who can access them online.
What happened?
CISA has published an advisory about a critical vulnerability (CVE-2026-84411) in MikroTik RouterOS, affecting versions before 7.24. The flaw could let attackers run code or crash the device. No exploitation has been reported yet.
What is the MikroTik RouterOS vulnerability?
A new security flaw (CVE-2026-84411) has been found in MikroTik RouterOS, the operating system used in many MikroTik routers worldwide. According to the US Cybersecurity and Infrastructure Security Agency (CISA), this vulnerability affects all RouterOS versions before 7.24. The flaw is rated as critical, with a CVSS score of 9.8, meaning it is easy to exploit and could have a severe impact if abused [CISA (opens in a new tab)].
What could an attacker do?
CISA says that a successful attack could let someone run their own code on the affected device (remote code execution) or cause the router to crash (denial of service). This means an attacker could potentially take full control of the router, intercept network traffic, or use the device as a launchpad for further attacks. The vulnerability is in the web management service, which is often used by administrators to configure the router.
Who is at risk?
MikroTik routers are used by businesses, internet service providers, and individuals around the world. The devices are popular in the communications and information technology sectors. Because these routers often sit at the edge of networks, a compromise could expose entire organisations to further risk.
What has been reported so far?
The vulnerability was reported to CISA by an anonymous researcher. As of 29 September 2026, CISA says there is no evidence that attackers are exploiting this flaw in the wild. However, because the details are now public, attackers may soon try to find and target unpatched devices.
CISA recommends that users update to RouterOS version 7.24 or later as soon as possible. They also advise minimising network exposure by keeping routers off the public internet where possible, placing them behind firewalls, and using secure remote access methods like VPNs (which themselves must be kept up to date).
What should users and organisations do?
- Update MikroTik RouterOS to the latest version (7.24 or newer).
- Restrict access to the router's web management interface, ideally limiting it to trusted networks only.
- Place routers behind firewalls and separate them from business-critical systems.
- Use secure remote access solutions, but keep in mind that VPNs also need regular updates.
- Monitor for signs of suspicious activity and follow your organisation's incident response procedures if you suspect compromise.
CISA provides further guidance and best practices for securing industrial control systems and network devices on their ICS webpage.
What happens next?
With the vulnerability now public, attackers may begin scanning for unpatched MikroTik routers. Organisations should act quickly to patch and secure their devices. CISA encourages anyone who sees signs of exploitation to report it, so that incidents can be tracked and mitigated.
Practical advice
If you manage a MikroTik router, check its software version and update immediately if it is older than 7.24. Review who can access the management interface and restrict it as much as possible. Regularly check for security updates and follow best practices for network device security.
Claimed vs confirmed
- Confirmed
Attackers can exploit CVE-2026-84411 for remote code execution or denial of service.
CISA states this is possible if the flaw is exploited.
- Confirmed
No public exploitation of this vulnerability has been reported.
CISA reports no known attacks as of their advisory.
The impact
- Money
- If exploited, organisations could face costs from downtime, incident response, and possible regulatory fines. In the EU and UK, GDPR fines can reach up to €20m or £17.5m, or 4% of annual turnover, for breaches affecting personal data.
- Reputation
- A compromise of widely used routers could damage trust in affected organisations, especially if attackers intercept or disrupt network traffic.
- Customers
- Users of MikroTik routers should update their devices and restrict management access to reduce risk. Unpatched devices may be vulnerable to takeover or disruption.
Why it matters
MikroTik routers are widely used in businesses and critical infrastructure. A successful attack could give criminals control over network traffic or disrupt services. Unpatched devices are at high risk once details become public.
How does it work?
The flaw is an integer underflow in the web management service of MikroTik RouterOS. An attacker could exploit this to run code remotely or cause the router to crash.
Key points
- Critical flaw in MikroTik RouterOS before version 7.24
- Allows remote code execution or denial of service
- No attacks reported yet, but risk rises as details become public
- CISA urges immediate patching and network hardening
- Restrict management interface access and monitor for threats
Sources
CISA
Government
