CVE-2026-84411
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable b
CVSS
9.8
Critical
EPSS
0.9%
p60
KEV
—
Exploit Today
18
0-100
Published: Oct 2, 2026 · Last modified: Oct 3, 2026 · CWE-191
0.9%EPSS · 30 days0.9%
2026-10-032026-10-04
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-86537—44.2%
——13Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.3dCVE-2026-82459—34.6%
——10Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.3dCVE-2026-475857.8 HIG2.0%
——1NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.4dCVE-2026-475407.8 HIG2.6%
——1NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.4dCVE-2026-86133—25.2%
——8An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.5dCVE-2026-86132—27.0%
——8An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.5d