SB2026101701 - Multiple vulnerabilities in MikroTik RouterOS

Description

This security bulletin contains information about 2 vulnerabilities.

1) Integer overflow (CVE-ID: CVE-2026-84411) Exploited

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the administrative interface. A remote attacker can send specially crafted HTTP requests to the management interface of the device, trigger an integer overflow and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild. 

2) Incorrect authorization (CVE-ID: CVE-2026-103903)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to compromise accounts of other users.

The vulnerability exists due to incorrect authorization in the WinBox authentication. A remote authenticated low-privileged user can obtain the authorization policy of a different existing account, including device administrators.

Remediation

Install update from vendor's website.

References

• https://mikrotik.com/download/changelogs#7.23.8
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06