A stack buffer overflow vulnerability has been identified in the SNMP service of RouterOS (the service behind /snmp, listening on UDP port 161). A single specially crafted SNMP request - version 1 or 2c - that carries an OID with many large sub-identifiers can crash the SNMP process. The request does not need a login: only a valid community string is required, and the default public community is accepted from any address. The issue has been assigned CVE-2026-88464.
Who is affected: RouterOS versions 7.20 and up to the fixed releases listed below. The vulnerable code was introduced in RouterOS 7.20; RouterOS 6 and versions before 7.20 are not affected. To trigger the issue, the SNMP service must be enabled and reachable by the attacker - from the local network, or from the internet if SNMP is exposed on the WAN. SNMP is not enabled by default.
Although the public report describes a crash, we treat this issue seriously.
This issue is fixed in:
Users are advised to upgrade to one of these versions or any later release.
Until you upgrade, disable SNMP if you do not use it, or restrict it to trusted addresses and make sure UDP port 161 is not reachable from untrusted networks.
MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall to limit exposure from untrusted networks.
Contact us about vulnerabilities