CVE-2026-84411 is a pre-authentication flaw in the web-management service of MikroTik RouterOS. RouterOS is the Linux-based operating system behind MikroTik routers, switches and wireless gear, as well as x86 and virtual deployments. It is used by ISPs, businesses and individual operators, from home and small-office networks through enterprise, data-centre and national-provider environments.
The important condition is reachability, not a valid WebFig account. If an attacker can connect to the www or www-ssl service, a single crafted HTTP request can trigger the bug before RouterOS asks them to authenticate. MikroTik says that can either crash the service or result in code execution with full router privileges—effectively root on the appliance.
A request length calculation crosses below zero
The defect is an integer underflow while the WebFig service handles an HTTP request body. Put simply, a calculation that should represent a valid non-negative size drops below zero after receiving malformed input. Later request processing can then operate on the wrong size or boundary, creating a path to a denial of service or arbitrary code execution.
There is no verified source-level detail beyond that description. The available material does not identify the affected function, integer type, HTTP field, arithmetic expression or missing bounds check, and no vendor patch diff has been published. That matters for defenders: do not treat apparent similarity to some other WebFig parsing issue as confirmation that it is this bug.
Reachable management planes are the exposure
MikroTik identifies all RouterOS releases before 7.24, including RouterOS 6, as affected when the web interface is reachable by the attacker. Its advisory says RouterOS 7.24 and later are unaffected. The stable RouterOS 7 branch has been fixed since 7.24; fixes for RouterOS 7 long-term and RouterOS 6 long-term were still pending as of October 8.
That makes this especially relevant to organisations that expose router administration to the Internet, but internal reachability also counts. MikroTik says the default firewall blocks Internet access to the web interface, while leaving it reachable on the local network. A compromised workstation, hostile guest segment or poorly separated operations network could therefore provide the necessary position even where the WAN firewall is intact. Censys observed 439,624 web properties exposing an identifiable RouterOS management interface, though that is exposure telemetry, not proof that those systems run a vulnerable version.
Upgrade stable-branch systems to 7.24 or later. Where that is not possible—or for the long-term branches awaiting a confirmed fix—disable www and www-ssl or restrict both to narrowly defined trusted administration addresses. Review firewall rules, VPN access paths, address lists and any port forwards rather than assuming an interface is private. Teams should also look for unexpected RouterOS configuration changes and management-plane traffic, although no indicator set is supplied for this flaw.
No verified exploitation or public exploit
As of October 8, there was no confirmed in-the-wild exploitation of CVE-2026-84411, no confirmed related campaign, and it was not in CISA’s Known Exploited Vulnerabilities catalogue. CISA’s coordinated advisory record says no known public exploitation targeting it had been reported to the agency. No public proof of concept or exploit code could be verified either; one aggregator labels an exploit as available but supplies no code or attributable reference, so that claim cannot be confirmed.
This is still a patch-now management-plane issue: authentication does not stand between a reachable service and the malformed request. Inventory where WebFig is enabled, remove unnecessary exposure, and use SecAlerts to monitor an organisation’s actual software stack and alert on new vulnerabilities affecting the products it runs.
