CVE-2026-84411: Integer underflow in RouterOS web management

CVE-2026-84411 is an integer underflow vulnerability in the RouterOS web management service. The attack is reachable before authentication and can be exploited by an unauthenticated network attacker to achieve arbitrary code execution as root or cause a denial of service via a single crafted HTTP request.

The vulnerability has a CVSS score of 9.8 and is classified as critical, with severity verified in official data. It was published by NVD on October 2, 2026. As of November 7, 2026, exploitation signals have emerged: public repositories on GitHub claim to contain exploits for this vulnerability. These signals indicate active technical community interest.

For defenders: RouterOS systems directly exposed to untrusted networks must be prioritized for patching. Until official patches are released, implement access restrictions to the web management service by limiting network exposure and isolating critical RouterOS devices. Monitor access logs for anomalous HTTP requests to the web service.

The lack of authentication required for the attack makes it extremely critical for any RouterOS deployment accessible from the network. Administrators must audit their device inventory and determine deployed versions. It is not advisable to download exploits from public repositories: priority should be given to finding official patches from the vendor and applying them promptly.