CVE-2026-84411

9.8 CRITICALpublic exploit available

Published 2026-10-02 · Updated 2026-10-06

AI risk analysis

Summary: This flaw involves an integer underflow in HTTP request body handling in RouterOS, allowing unauthenticated attackers to execute arbitrary code as root or cause a denial of service.
Exploitability: Exploitation is relatively straightforward as it requires only a single crafted request from an unauthenticated attacker.
Blast radius: If exploited, the impact could be severe, including full system compromise or service disruption.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to RouterOS 7.40.1 or later.

rcewebauth-bypassdosrouteros

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-191

Public exploit & PoC references

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-06.json

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.