MikroTik Security Advisories & CVEs
19 advisories tracked · MikroTik Security Announcements + NVD · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor MikroTik CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Check if your MikroTik device is affected
Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in MikroTik's recent advisories.
Official source
MikroTik Security Announcements + NVD
MikroTik publishes official security announcements at mikrotik.com/supportsec, but has no machine-readable feed and its CVEs are assigned by several CNAs. VulniPulse joins NVD candidate metadata to the server-rendered official announcement index, then releases an alert only after fetching the linked article and verifying its CVE identity in the article heading or body. Covers RouterOS (v6/v7), SwOS, Winbox, The Dude and MikroTik router/switch hardware (hEX, CCR, CRS, cAP, wAP).
Latest MikroTik advisories
Medium [CVE-2026-89021] MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths
A path traversal vulnerability has been identified in the RouterOS container feature. When importing a container image, specially crafted links inside the image could cause files to be written or deleted outside of the container’s own directory, anywhere on the router’s storage. The container does not need to be started for this to happen, importing the image is enough. The issue has been assigned CVE-2026-89021. Who is affected: Only devices that use the container feature. The container package is not installed by default, and the feature has to be explicitly enabled by the administrator. If you do not use containers, you are not affected. RouterOS 6 does not have the container feature and is not affected. Who can trigger it: A user with the rights to add containers on the router. The risk comes from container images obtained from untrusted sources, so this is especially relevant if you pull images from public registries. This issue is fixed in RouterOS 7.24.2 (stable) and later releases. Note for long-term users: this fix is not included in the 7.23.x long-term branch and there is no backport planned. Affected product named by the advisory: MikroTik RouterOS.
Medium [CVE-2026-89020] MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes
A buffer overflow vulnerability has been identified in the “fetch” tool of RouterOS (/tool fetch), when it is given a very long tftp:// address. A logged-in user can use this to crash the fetch process. The issue has been assigned CVE-2026-89020. Who is affected: RouterOS versions 6 and 7 before the fixed releases listed below. To trigger the issue, the attacker needs a valid username and password on the router. Even a read-only user can trigger it, so this matters for devices with multiple user accounts or shared logins. Although the public report describes a crash, we treat this issue seriously, because memory corruption issues of this type can sometimes be abused for more than a crash. We recommend upgrading rather than relying on the limited user rights of your accounts. This issue is fixed in: 7.24.2 (stable). 7.23.4 (long-term). Users are advised to upgrade to one of these versions or any later release. Until you upgrade, review the user accounts on your router, remove accounts that are no longer needed, and make sure management services are not reachable from untrusted networks. Affected product named by the advisory: MikroTik RouterOS.
Critical [CVE-2026-86060] SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels. This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information. Your device should already give you the option to upgrade software in the “Check for updates” menu. Fix is included in: 7.25 beta 3. 7.24.2. 7.23.4. 6.49.21. For regular home device users the issue does not pose an immediate risk, but we still suggest all users to upgrade. Steps to be taken Make sure SSH is not open to any untrusted networks. MikroTik default configuration blocks this port from the internet by default, but if you have manually opened this port, make sure only trusted IP can access it, or better yet, use a strong VPN like WireGuard to access your router and do not open any management ports at all. RouterOS will check if your device has been compromised, and set it to “Flagged” status if it is. This will be written in the “Log” section. Affected product named by the advisory: MikroTik RouterOS.
Critical [CVE-2026-67276] SSH user impersonation possible in Mikrotik RouterOS
MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels. This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information. Your device should already give you the option to upgrade software in the “Check for updates” menu. Fix is included in: 7.25 beta 3. 7.24.2. 7.23.4. 6.49.21. For regular home device users the issue does not pose an immediate risk, but we still suggest all users to upgrade. Steps to be taken Make sure SSH is not open to any untrusted networks. MikroTik default configuration blocks this port from the internet by default, but if you have manually opened this port, make sure only trusted IP can access it, or better yet, use a strong VPN like WireGuard to access your router and do not open any management ports at all. RouterOS will check if your device has been compromised, and set it to “Flagged” status if it is. This will be written in the “Log” section. Affected product named by the advisory: MikroTik RouterOS.
High [CVE-2026-67281] Unauthenticated file read in Mikrotik RouterOS
MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels. This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. Update 2026-10-06: this article now lists all six issues from the original report, including a corrected fix version for one of them (see below). The CVE numbers were initially withheld to give users time to upgrade. Your device should already give you the option to upgrade software in the “Check for updates” menu. Fix is included in: 7.25 beta 3. 7.24.2. 7.23.4. 6.49.21. Important: the fix for one of the issues (CVE-2026-67278, forged certificates and SSH host keys) in 7.24.2 and 7.23.4 was found to be incomplete. The complete fix is included in 7.24.3 (stable) and 7.23.6 (long-term). If you already upgraded in September, please upgrade again to one of these versions or any later release. RouterOS 6 is not affected by this particular issue. For regular home device users the issue does not pose an immediate risk, but we still suggest all users to upgrade. Affected product named by the advisory: MikroTik RouterOS.
High [CVE-2026-67277] Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels. This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information. Your device should already give you the option to upgrade software in the “Check for updates” menu. Fix is included in: 7.25 beta 3. 7.24.2. 7.23.4. 6.49.21. For regular home device users the issue does not pose an immediate risk, but we still suggest all users to upgrade. Steps to be taken Make sure SSH is not open to any untrusted networks. MikroTik default configuration blocks this port from the internet by default, but if you have manually opened this port, make sure only trusted IP can access it, or better yet, use a strong VPN like WireGuard to access your router and do not open any management ports at all. RouterOS will check if your device has been compromised, and set it to “Flagged” status if it is. This will be written in the “Log” section. Affected product named by the advisory: MikroTik RouterOS.
Medium [CVE-2026-67279] SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels. This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. Update 2026-10-06: this article now lists all six issues from the original report, including a corrected fix version for one of them (see below). The CVE numbers were initially withheld to give users time to upgrade. Your device should already give you the option to upgrade software in the “Check for updates” menu. Fix is included in: 7.25 beta 3. 7.24.2. 7.23.4. 6.49.21. Important: the fix for one of the issues (CVE-2026-67278, forged certificates and SSH host keys) in 7.24.2 and 7.23.4 was found to be incomplete. The complete fix is included in 7.24.3 (stable) and 7.23.6 (long-term). If you already upgraded in September, please upgrade again to one of these versions or any later release. RouterOS 6 is not affected by this particular issue. For regular home device users the issue does not pose an immediate risk, but we still suggest all users to upgrade. Affected product named by the advisory: MikroTik RouterOS.
Medium [CVE-2026-67278] MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. The same permissive verification also undermines RSA-based SSH authentication. This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable). Releases 7.23.4 and 7.24.2 included an incomplete fix.
High [CVE-2024-27686] Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the SMB service on TCP port 445
The SMB service in RouterOS 6 could be affected by a specially crafted SMB session setup packet. In the reported scenario, this could interrupt the active SMB session, which may also interrupt an ongoing file transfer that depends on that session. This issue is fixed in RouterOS 6.49.14. RouterOS version 7 is not affected. MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall so SMB and other device services are not reachable from untrusted networks. Affected product named by the advisory: MikroTik RouterOS.
High [CVE-2025-10948] RouterOS: vulnerability has been found in MikroTik RouterOS 7.
A buffer overflow vulnerability has been discovered in MikroTik RouterOS 7, affecting the parse_json_element function within the libjson.so component. The vulnerability is triggered through the /rest/ip/address/print endpoint and can be exploited remotely. The exploit for this issue has been publicly disclosed and may be actively used. Upgrading to RouterOS version 7.20.1 or 7.21beta2 mitigates this issue. The vendor has confirmed that a fix has been implemented and plans to release a RouterOS update containing the patch. Users should upgrade to the latest available version to ensure full protection. MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall so REST API and management services are available only from trusted networks.
Advisory [CVE-2025-6563] RouterOS: cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2.
A cross-site scripting (XSS) vulnerability has been discovered in the hotspot functionality of MikroTik RouterOS, affecting versions below 7.19.2. An attacker can inject the javascript protocol via the dst parameter in a crafted URL. When a victim browses to this malicious URL and logs in through the hotspot page, the injected XSS payload executes in their browser. Additionally, the POST request used for login can be converted to a GET request. This allows an attacker to craft a URL that automatically logs the victim into the attacker’s account and triggers the payload, requiring no interaction beyond visiting the link. Users are advised to upgrade to RouterOS 7.20 or any later version to address this vulnerability. MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall to protect router management services from untrusted networks; hotspot access should still be configured only as broadly as the deployment requires.
Medium [CVE-2023-47310] misconfiguration in the default settings of MikroTik RouterOS 7 allows incoming IPv6 UDP traceroute packets, which
A misconfiguration in the default settings of MikroTik RouterOS 7 allows incoming IPv6 UDP traceroute packets, which could permit unauthorized network reconnaissance from external sources. Users are advised to upgrade to RouterOS 6.49.13, 7.14, or any later version to address this vulnerability. MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall to protect the device from traffic arriving from untrusted networks.
High [CVE-2025-6443] RouterOS: Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability.
An improper access control vulnerability has been identified in MikroTik RouterOS, related to the handling of VXLAN source IP addresses. This flaw allows remote attackers to bypass access restrictions on affected installations without requiring authentication. The specific issue exists within the processing of remote IP addresses during VXLAN traffic handling. The router fails to validate the remote IP address against configured values before allowing ingress traffic into the internal network. An attacker can exploit this lack of validation to gain unauthorized access to internal network resources. This vulnerability was tracked as ZDI-CAN-26415. Users are advised to upgrade to RouterOS 7.20 or any later version to mitigate this vulnerability. MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall to limit exposure from untrusted networks, including traffic to services or tunnel endpoints that should be reachable only from trusted peers.
High [CVE-2024-54952] RouterOS: MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability.
A memory corruption vulnerability has been discovered in the SMB service of MikroTik RouterOS. Remote, unauthenticated attackers can exploit this issue by sending specially crafted packets to the SMB service, triggering a null pointer dereference. This results in a remote denial of service (DoS) condition, rendering the SMB service unavailable. Users are advised to upgrade to the latest RouterOS 7.x stable release to address this vulnerability. MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall so SMB and other device services are not reachable from untrusted networks.
Medium [CVE-2024-54772] MikroTik RouterOS: Issue Summary A vulnerability has been identified in the WinBox service, where a discrepancy in response size between connection…
Issue Summary A vulnerability has been identified in the WinBox service, where a discrepancy in response size between connection attempts with valid and invalid usernames allows attackers to confirm if user accounts exists via brute forcing the login process. In other words, when attacker tries to log into the device, by examining the response, the attacker can deduce if such a user exists on the device. Even if username is found, password still needs to be guessed as well. Affected Versions RouterOS versions prior to 6.49.18 and 7.18. Recommended Actions Update RouterOS – Upgrade to 6.49.18, 7.18, or a newer version to patch the vulnerability. Monitor for unusual login attempts – Review router logs for suspicious authentication activity and take action accordingly. MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall so WinBox and other management services are not reachable from untrusted networks. Mitigation strategies for devices that cannot be updated immediately Restrict WinBox Access. Firewall the WinBox port on public interfaces and untrusted networks. Affected products named by the advisory: MikroTik RouterOS.
High [CVE-2023-32154] RouterOS: Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability.
On 10/05/2023 (May 10th, 2023) MikroTik received information about a new vulnerability, which is assigned the ID CVE-2023-32154. The report stated, that vendor (MikroTik) was contacted in December, but we did not find record of such communication. The original report also says, that vendor was informed in person in an event in Toronto, where MikroTik was not present in any capacity. What this issue affects: The issue affects devices running MikroTik RouterOS versions v6.xx and v7.xx with enabled IPv6 advertisement receiver functionality. You are only affected if one of the below settings is applied: ipv6/settings/ set accept-router-advertisements=yes or ipv6/settings/set forward=no accept-router-advertisements=yes-if-forwarding-disabled If the above settings are not set up like in the example, you are not affected. Note that the vulnerable setting combination is not normally found in routers and is rarely used. What this issue can cause: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability.
Medium [CVE-2023-41570] RouterOS: MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.
MikroTik RouterOS versions 7.1 through 7.11 contained an access control issue in the REST API. The issue applied to installations where the REST API was enabled and reachable, and could allow requests to be handled with incorrect access control. This issue is fixed in RouterOS 7.12 and newer releases. MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall so API and management services are available only from trusted networks.
High [CVE-2023-30800] RouterOS: The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue.
The web server used by MikroTik RouterOS version 6 was affected by a heap memory corruption issue. In specific conditions, a crafted HTTP request could cause the web interface service to crash and restart. This affected the availability of the web interface, while the service restarted automatically. This issue is fixed in RouterOS 6.49.10 stable. MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall so web and management services are not reachable from untrusted networks.
Critical [CVE-2023-30799] RouterOS: MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue.
A new CVE has been published, which describes a policy elevation issue, where a logged in administrator with “policy” permissions (able to grant additional permissions to any user on the router), is also able to send crafted configuration commands, that are exchanged internally by the router software components and normally are rejected when sent by a user. This can be used as a stepping stone to execute arbitrary code on the router, allowing the connected user to gain control of the underlying operating system upon which RouterOS runs. To be able to use this discovered exploit, one would need administrative access to RouterOS, i.e. a known username and password, as well as a ways to connect (no firewall). This is not the only way how a logged in administrator user with such a high access level (as required for this exploit) can compromise the router. Other possibilities include: saving, modifying and restoring configuration backup; installing additional software packages; using another device on the local network to perform network reinstall of the router to a known vulnerable version. Affected product named by the advisory: MikroTik RouterOS.