Home › MikroTik RouterOS
MikroTik RouterOS: which version is safe to update to?
Operating system for MikroTik routers and switches (stable channel). Every release below is checked against official notes, NVD CVE data and public community reports.
All recent releases
7.23.8 security 2 CVEs
No problems reported
7.24.5 security 1 CVE
Safe to update
7.24.4
No problems reported
7.23.7
No problems reported
7.24.3 security 2 CVEs
No problems reported
7.23.6 security 2 CVEs
No problems reported
7.23.5
No widespread problems
7.24.2 3 CVEs
Safe to update
7.23.4 2 CVEs
No problems reported
7.24.1
No widespread problems
7.24 security 2 CVEs
No problems reported
7.23.3
No widespread problems
7.23.2
No problems reported
7.23.1
No problems reported
7.23
No widespread problems
7.22.3
Problems reported
7.22.2
Safe to update
Recent CVEs (last 120 days)
- CVE-2026-84411 CRITICAL 9.3 The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attac…
- CVE-2026-103903 HIGH 8.7 An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the a…
- CVE-2026-16347 HIGH 8.7 MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source…
- CVE-2026-93345 HIGH 8.7 MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service b…
- CVE-2026-89028 HIGH 8.2 MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 S…
- CVE-2026-39042 HIGH 7.5 An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten() function in libumsg.so.
- CVE-2026-14227 MEDIUM 6.9 An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission s…
- CVE-2026-89021 MEDIUM 6.9 MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container…
The weekly "safe to update?" email
One short email a week: what shipped, what broke, and what's safe to install. No spam.
Thanks — you're on the list.
We store only your email address and the date you signed up, to send this newsletter. We never sell or share it. Every email will have a one-click unsubscribe; you can also ask us to delete your address at any time. Privacy details.