CISA Warns of Critical MikroTik RouterOS RCE Flaw

CISA warns that CVE-2026-84411, a pre-auth integer underflow in MikroTik RouterOS web management, lets unauthenticated attackers execute code as root or cause denial of service with one crafted request. RouterOS versions below 7.24 are affected; MikroTik recommends updating to 7.23 or later. No active exploitation is known, but the vendor has not published an advisory.