CISA warns a single unauthenticated request can root MikroTik RouterOS below 7.24

The preconditions are short. An attacker needs network access to the RouterOS web management service and one crafted request, with no account on the device ^[3]. The flaw sits ahead of the login check. "The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication," CISA wrote ^[2]. The weakness is filed as CWE-191, integer underflow or wraparound ^[4].

The version guidance does not agree with itself. CISA lists every RouterOS release below 7.24 as affected ^[5]. The same advisory says MikroTik recommends updating to 7.23 or later ^[7]. According to BleepingComputer, MikroTik's current long-term build is 7.23.7 and its current stable build is 7.24.4, both available since September 16 ^[12]. Read literally, 7.23.7 meets the vendor's floor and still falls inside CISA's affected range ^[19]. Of the two current builds, only 7.24.4 sits outside it ^[20]. Both had been out for 13 days when CISA published ^[18]. BleepingComputer asked MikroTik and CISA to clarify which versions are affected and had no answer at publication ^[13].

CISA's recommended practices are its standard control-system list: keep devices off the internet, put control networks behind firewalls isolated from business networks, and use updated VPNs for remote access ^[9]. For this bug the control that matters is narrower. The advisory's only stated precondition is network reach to the web management service ^[14]. Restricting which hosts can reach that service closes the path for every host outside the allowed set, whatever version the router runs ^[14].

Hackers and botnet malware often target MikroTik flaws, BleepingComputer reported ^[10]. Poland's CERT recently warned, according to BleepingComputer, that attackers chained CVE-2026-67276 and CVE-2026-86060 to take full control of RouterOS devices with SSH exposed to the internet ^[11]. That chain needed two flaws and an open SSH service ^[11]. CVE-2026-84411 needs one request to the web interface ^[1][3].