Skip to content
Threat Feed
Subscribe
high advisory

MikroTik RouterOS WebFig jsproxy Denial of Service (CVE-2026-84411)

A pre-auth integer underflow in the MikroTik RouterOS WebFig /jsproxy endpoint allows unauthenticated attackers to cause a denial-of-service by triggering a crash of the www process.

CVE search metadata

CVE search record: CVE-2026-84411. Severity: critical. CVSS: 9.8. EPSS: 0.86%. KEV: no. Product: RouterOS (< 7.23.6, 7.24.3). Brief: MikroTik RouterOS WebFig jsproxy Denial of Service (CVE-2026-84411). Brief link: https://feed.craftedsignal.io/briefs/2026-11-mikrotik-routeros-jsproxy-overflow/

Triage facts

Revision 1
Applicability
RouterOS (< 7.23.6, 7.24.3)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Nov 8, 13:45 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Likely

CVE-2026-84411 is a pre-auth integer underflow vulnerability in the MikroTik RouterOS WebFig interface's /jsproxy endpoint. The flaw is triggered when a specially crafted HTTP POST request with a 'Content-Type: msg' header is followed by a 'Content-Length' header that is smaller than the actual request body. Publicly available exploit modules demonstrate that this vulnerability can be leveraged to conduct denial-of-service (DoS) attacks by terminating the www process. No public weaponized RCE exploit is currently available, but the availability of reliable crash-mode PoC code increases the risk of service disruption.

Impact

The vulnerability results in a denial-of-service by crashing the web management service (www process) on affected MikroTik devices. This renders the WebFig interface unavailable until the service is manually recovered or the device is rebooted.

Recommendation

  • Upgrade RouterOS to version 7.23.6, 7.24.3, or later to address the vulnerable jsproxy handling.
  • Restrict access to the WebFig interface (typically port 80/443) to trusted management subnets via IP firewall filter rules.
  • Inventory all internet-exposed MikroTik routers and prioritize patching or isolating the management interface.

Immediate actions

Patch RouterOS on all internet-facing devices to 7.23.6 or 7.24.3.

IT Operations 24h

Threat Hunt

Identify repeated POST requests to /jsproxy followed by service outage patterns.

T1499.004 high medium confidence hunt now

Data: Web server logs, Device uptime / process status logs

Mitigations

Restrict access to management ports 80/443 for MikroTik devices.

immediate IT Operations

CVE-2026-84411

Detection coverage 1

Detect Potential CVE-2026-84411 Exploitation Attempt

high

Detects malformed HTTP POST requests to the /jsproxy endpoint where Content-Type is msg and the body length mismatch is characteristic of the integer underflow vulnerability.

sigma tactics: denial_of_service techniques: T1499.004 sources: webserver

Detection queries are available on the platform. Get full rules →