Loading story…
CISA issued advisory ICSA-26-272-06 for CVE-2026-84411, a critical CVSS 9.8 integer-underflow flaw in MikroTik RouterOS web-management HTTP request handling. A remote, unauthenticated attacker can reportedly send a crafted request to execute arbitrary code with root privileges or trigger denial of service on affected RouterOS releases before version 7.24. CISA reported no evidence of active exploitation at publication, while noting ambiguity in referenced remediation guidance that cited version 7.23 or later despite identifying versions below 7.24 as affected.
An internet-exposed compromised router could permit traffic interception or redirection, DNS and firewall manipulation, persistence, internal reconnaissance, and lateral movement into enterprise or operational-technology networks. Organizations should upgrade to RouterOS 7.24 or later, remove management interfaces from public exposure, segment router management networks, and require secured VPN access for remote administration. Defenders should investigate unexpected configuration or script changes, DNS modifications, anomalous outbound traffic, and unknown accounts.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CISA published advisory ICSA-26-272-06 for CVE-2026-84411, a CVSS 9.8 pre-authentication integer-underflow vulnerability affecting MikroTik RouterOS versions earlier than 7.24. The flaw may allow an unauthenticated remote attacker to execute code with root privileges or cause denial of service; CISA reported no known public exploitation targeting the CVE.
MikroTik made RouterOS 7.24.4, the latest stable release, and RouterOS 7.23.7, the latest long-term release, available. CISA's reporting contained conflicting version guidance for CVE-2026-84411, while other reporting identified 7.24 or later as the mitigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed **MikroTrick**, an exploit chain combining `CVE-2026-67279`, an SSH rekey state-machine flaw, with `CVE-2026-86060`, an argument-injection vulnerability in RouterOS SSH login handling. The chain provides unauthenticated access to the full administrative console on affected MikroTik devices. MikroTik issued fixes in RouterOS `7.25beta3`, `7.24.2`, `7.23.4`, and `6.49.21`, initially without detailed vulnerability information. Evidence indicates exploitation began before patches were available. Activity linked to `82.192.72.4` attempted authentication using the username `-2`, created a privileged `ops` account, and likely exfiltrated diagnostic files. CISA added `CVE-2026-86060` and related RouterOS SSH issue `CVE-2026-67277` to its Known Exploited Vulnerabilities Catalog with a three-day remediation deadline. Organizations should urgently upgrade exposed RouterOS devices, investigate for unauthorized accounts and suspicious SSH activity, and assess potential data exposure.
Sep 28, 2026
Active exploitation of the **MikroTrick** vulnerability chain is allowing attackers to take over internet-exposed MikroTik RouterOS devices without credentials. The attack combines an SSH rekeying authentication-state bypass—reported as `CVE-2026-67279` (though one advisory lists `CVE-2026-67277`)—with `CVE-2026-86060`, in which a crafted username can make the RouterOS login helper accept an attacker-controlled privileged identity. Researchers reproduced full administrative compromise on vulnerable RouterOS 7.x systems, enabling access-control bypass, persistence, and potential lateral movement into connected networks; CISA has added the flaws to its Known Exploited Vulnerabilities catalog. MikroTik has issued fixes in RouterOS `6.49.21`, `7.23.4`, `7.24.2`, and subsequent applicable releases. Organizations should immediately patch exposed routers, restrict external exposure of Winbox and API services, and audit administrator accounts. They should also investigate devices for attacker-created privileged accounts, scripts, and scheduled tasks, because patching alone will not remove persistence or rotate credentials that may have been exposed during compromise.
Sep 18, 2026
MikroTik patched six vulnerabilities in RouterOS releases earlier than `6.49.21`, `7.23.4`, and `7.24.2`. CERT Polska reported flaws affecting SSH authentication and RSA signature validation, WebFig file access, the `btest` service, and SSH login privilege handling. The issues can permit unauthenticated remote SSH command execution, disclosure of root-owned files that may contain credentials, kernel restarts, privilege escalation, and TLS server impersonation. Organizations running affected RouterOS branches should upgrade immediately to RouterOS `6.49.21` (Long-term), `7.23.4` (Long-term), or `7.24.2` (Stable). Administrators should review RouterOS flagged status and logs for compromise evidence, and investigate unauthorized accounts, scripts, scheduled tasks, firewall, VPN, DNS, NAT, and other configuration changes, particularly on internet-exposed devices.
Sep 11, 2026