CVE-2026-844119.8CriticalCWE-191
CVE-2026-84411: MikroTik RouterOS Integer Underflow
MikroTik · RouterOS
Vendor fix available · Affected: MikroTik RouterOS · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub10 Oct
- Not established: not seen
0.9%probability of exploitation in the next 30 days
59th percentile
050100
Higher than 59% of scored CVEs
9.8CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- MikroTik
- Published
- October 2026
What changed
- PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 29 Sep.
- CISA Warns of Critical Unauthenticated RCE in MikroTik RouterOSSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.