An issue has been published regarding how RouterOS services decide which certificate authorities (CAs) to trust. Several RouterOS services, such as OpenVPN, CAPsMAN and Dot1X (802.1X), use certificates to verify who they are talking to. In affected versions these services all use the same system-wide certificate store, so any CA certificate that is trusted on the router is trusted by every service. The issue has been assigned CVE-2025-42611 and was reported by SI-CERT.
What this means in practice: if your router has several CA certificates installed, for example one for OpenVPN and another for a CAPsMAN setup, a certificate issued by one CA could be accepted by a service that was only meant to trust the other one. Depending on your setup, this could allow a device or user to authenticate where it should not. An attacker still needs a certificate issued by one of the CAs already installed on your router, so a router with a single CA, or with no certificate-based services at all, is not at risk.
Who is affected: RouterOS versions before 7.21 (including RouterOS 6), on devices that use more than one CA certificate with certificate-verified services.
Current status: RouterOS 7.21 introduced the ability to limit which CA each service trusts. This addresses the issue, but only if you configure it: after upgrading, review your OpenVPN, CAPsMAN and Dot1X settings and make sure each one is set to trust only the CA that is meant for it, instead of relying on the system-wide store.
Vulnerability scanners may report this CVE on any RouterOS version. As described above, the actual exposure depends on your configuration.
MikroTik always recommends keeping RouterOS devices up to date, using a separate CA for each purpose, and removing CA certificates that are no longer needed from the router.
An integer underflow in HTTP request body handling has been identified in the RouterOS web management service (the service behind WebFig, listening on the www and www-ssl ports). A single specially crafted HTTP request, sent without logging in, could crash the service or allow an attacker to execute code on the router with full privileges. This issue has been assigned CVE-2026-84411 and is rated critical.
Who is affected: RouterOS versions before 7.24 (including RouterOS v6), on devices where the web interface is reachable by the attacker.
Who is not affected: Devices already running RouterOS 7.24 or later. This issue is fixed in 7.24, so users on older versions should upgrade to the current stable release.
Fix status:
If you cannot upgrade immediately, make sure the web interface is not reachable from untrusted networks: restrict the www and www-ssl services in the “IP → Services” menu to trusted addresses, or disable them if you manage the router using WinBox or SSH. Note that in the default configuration the firewall already blocks the web interface from the internet, so a device with default firewall rules is only reachable from the local network. Better yet, use a VPN such as WireGuard to reach the router and do not open any management ports at all.
MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall so web and other management services are not reachable from untrusted networks.
This article will be updated with more information in due time.
A buffer overflow vulnerability has been identified in the “fetch” tool of RouterOS (/tool fetch), when it is given a very long tftp:// address. A logged-in user can use this to crash the fetch process. The issue has been assigned CVE-2026-89020.
Who is affected: RouterOS versions 6 and 7 before the fixed releases listed below. To trigger the issue, the attacker needs a valid username and password on the router. Even a read-only user can trigger it, so this matters for devices with multiple user accounts or shared logins.
Although the public report describes a crash, we treat this issue seriously, because memory corruption issues of this type can sometimes be abused for more than a crash. We recommend upgrading rather than relying on the limited user rights of your accounts.
This issue is fixed in:
Users are advised to upgrade to one of these versions or any later release.
Until you upgrade, review the user accounts on your router, remove accounts that are no longer needed, and make sure management services are not reachable from untrusted networks.
MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall to limit exposure from untrusted networks.
A path traversal vulnerability has been identified in the RouterOS container feature. When importing a container image, specially crafted links inside the image could cause files to be written or deleted outside of the container’s own directory, anywhere on the router’s storage. The container does not need to be started for this to happen, importing the image is enough. The issue has been assigned CVE-2026-89021.
Who is affected: Only devices that use the container feature. The container package is not installed by default, and the feature has to be explicitly enabled by the administrator. If you do not use containers, you are not affected. RouterOS 6 does not have the container feature and is not affected.
Who can trigger it: A user with the rights to add containers on the router. The risk comes from container images obtained from untrusted sources, so this is especially relevant if you pull images from public registries.
This issue is fixed in RouterOS 7.24.2 (stable) and later releases.
Note for long-term users: this fix is not included in the 7.23.x long-term branch and there is no backport planned. If you use containers on a long-term release, upgrade to the stable branch (7.24.2 or later), or only import container images that you build yourself or obtain from a trusted source.
MikroTik always recommends keeping RouterOS devices up to date, only running container images from sources you trust, and using a strong firewall to limit exposure from untrusted networks.
An out-of-bounds read vulnerability has been identified in MikroTik RouterOS, in the code that inspects TLS traffic for firewall rules that match TLS connections. A specially crafted packet could allow an attacker to crash the router or disclose a limited amount of memory contents. This issue was reported by Rasmus Moorats and is tracked as CVE-2026-52346.
The vulnerable code is only active on routers that have at least one firewall rule matching TLS connections (the tls-host feature), so devices that don’t use this feature are not affected. In most deployments the router’s firewall drops unsolicited traffic arriving from the internet, which prevents a maliciously crafted packet from reaching this code from the outside. A small number of configurations — such as port forwarding that exposes local services, or permissive firewall settings — could leave the router reachable from the internet. Even then, although the out-of-bounds read itself can be triggered from a distance, actually reading the leaked memory contents requires the ability to create firewall rules on the device, meaning an attacker would already need administrative access. In practice the risk for typical users is low, but upgrading is still strongly recommended.
This issue has been fixed. The fix is included in:
Users are advised to upgrade to one of these versions or any later release.
MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall to limit exposure from untrusted networks.
MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels.
This is an important security update. Most configurations are not at risk, but upgrading is highly recommended.
Update 2026-10-06: this article now lists all six issues from the original report, including a corrected fix version for one of them (see below). The CVE numbers were initially withheld to give users time to upgrade.
Your device should already give you the option to upgrade software in the “Check for updates” menu.
Fix is included in:
Important: the fix for one of the issues (CVE-2026-67278, forged certificates and SSH host keys) in 7.24.2 and 7.23.4 was found to be incomplete. The complete fix is included in 7.24.3 (stable) and 7.23.6 (long-term). If you already upgraded in September, please upgrade again to one of these versions or any later release. RouterOS 6 is not affected by this particular issue.
For regular home device users the issue does not pose an immediate risk, but we still suggest all users to upgrade.
Make sure SSH and the web interface (WebFig) are not open to any untrusted networks. MikroTik default configuration blocks these ports from the internet by default, but if you have manually opened them, make sure only trusted IP can access them, or better yet, use a strong VPN like WireGuard to access your router and do not open any management ports at all.
RouterOS will check if your device has been compromised, and set it to “Flagged” status if it is. This will be written in the “Log” section. If your log has a critical entry saying your device has been Flagged, please follow the instructions in the Flagged status documentation page.
Even if your device is not in Flagged state, after upgrading your RouterOS, inspect your device configuration for any unknown scripts, users or other config you do not recognise.
The issues were originally reported by CERT.pl under the codename “MikroTrick”. There are six CVE entries in total. In plain terms:
If your router is on 7.24.3, 7.23.6, 6.49.21 or any later release, all of the above are fixed.
Full technical details are available in the CERT.pl article and in the public CVE records.
Contact us about vulnerabilities