CVE-2026-84411CWE-191

CVE-2026-84411

Critical · published October 3, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
60.7
In the wild
Unconfirmed
What it is

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00945 · 60.7th percentile
Weakness
CWE-191 · Integer Underflow (Wrap or Wraparound)
Published
2026-10-03T03:16Z
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-06.json · [email protected]https://mikrotik.com/download · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06 · [email protected]
EPSS history
Timeline
  • 04 OCT 03:31Z
    EPSS moved — → 1%
    epss
  • 02 OCT 22:09Z
    MikroTik RouterOS Integer Underflow
    cvelistv5