Mikrotik News

Turn your hAP into a media server with Jellyfin and other apps! youtu.be/zS2JJ2LbSxE #YouTube channel: MikroTik 💬 ENG ESP POR УКР РУС 中文

RouterOS 7.23.3 [stable] released! Changelog*) certificate - added "ISRG Root X2", "Root YE" and "Root YR" to SMIPS built-in root certificate authorities store; *) certificate - added "Root YE" and "Root YR" to built-in root certificate authorities store; *) defconf - added virtual "iot-wifi" to MLO supporting devices; *) dhcpv4-server - fixed "expires-after" field for disabled static lease (introduced in v7.23); *) fastpath - properly fall back to SlowPath when FastPath is not possible due to fragmentation; *) ipsec - fixed identity lookup to skip past disabled and certificate-matched identities when scanning for an exact ID match; *) ipsec,ike2 - improved logging when remote ID is specified; *) ipsec,ike2 - use peer certificates also when identity has one set for peer matching; *) ipv6,ra - show warning about paused automatic RA on upgraded routers; *) ospf - fixed "duplicate config" issue when using ptp-unnumbered interface type; *) ptp - fixed a race condition when reading transmit timestamps, which could cause unstable clock offset under background traffic; *) ptp - fixed PTPv1 traffic forwarding when a PTPv2 profile is enabled on bridge ports; *) snmp - improved SNMPv3 request processing logic; *) system - added microSD card support for hAP be3 Media; *) system - improved handling of data re-sending on authorization requests (introduced in v7.22); *) system - improved stability; *) system - updated certificate for Windows executable signing; *) tftp - limit maximum simultaneous session count to 100; DownloadsMain: arm64 mipsbe mmips tile arm powerpc netinstall x86 x86-iso x86-dude x86-dude-client x86-netinstall64 x86-netinstall-cli btest.exe Extra: arm64 mipsbe mmips tile arm powerpc netinstall x86 Others: https://mikrotik.com/download GPT 💬 ENG ESP POR УКР РУС 中文

MikroTik: CVE-2026-14227 An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.

MikroTik: CVE-2026-16347 MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.

The Wi-Fi 7 media hub - a hybrid router for self-hosters/automation (hAP be³ Media) youtu.be/rbiYqFtfhUM #YouTube channel: MikroTik 💬 ENG ESP POR УКР РУС 中文

hAP be lite: the most affordable professional Wi-Fi 7 youtu.be/EZpgZ78HwJE #YouTube channel: MikroTik 💬 ENG ESP POR УКР РУС 中文

This AI can manage your home lab and networks! (Hermes explained) youtu.be/nRAdpq505JY #YouTube channel: MikroTik 💬 ENG ESP POR УКР РУС 中文

WinBox v4.3 released! Changelog What's new in 4.3 (2026-Jul-20 10:14): *) app: add Windows for arm64 version in file WinBox_Windows_arm64.zip; *) form: make multiline input field height logic as in WinBox v3; *) table: add quick comment feature (allow multi-row commenting); *) table: allow opening "Table settings" also via right mouse click; *) table: calculate implicit height to fit 16 regular rows including row paddings; *) table: fix quick filter sorting in some situations; *) table: improve performance on relayout which mostly happens when zooming; *) table: show collapsed tools right menu as dropdown button in table toolbar; - add global setting to change default tools position (right-side or toolbar); *) ui,settings: render font selection items with the respective font; *) ui: add app Quit option in Settings dropdown menu; *) ui: add fade effect to main menu when scrolling is available; *) ui: change login panel's selection widget from combobox to tabs; *) ui: layout main menu's submenu items in 1 column if space is available; *) ui: redesign opened windows selector popup; *) ui: rework scrolling so that it works when there is table within form and fix scrolling lag; Downloads macOS (universal) Linux (64-bit) Windows (64-bit) GPT 💬 ENG ESP POR УКР РУС 中文

MikroTik: CVE-2026-39042 An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten() function in libumsg.so.

RouterOS 7.23 changelog - VRF offloading, DoH with HTTP/2, option82 changes and more... youtu.be/8X0Aewng-BM #YouTube channel: MikroTik 💬 ENG ESP POR УКР РУС 中文

WinBox v4.2 released! Changelog What's new in 4.2 (2026-Jul-08 10:31): *) app: auto decrypt Saved address file in new window if parent window already provided it; *) form: add option to open linked objects for some read-only optional fields; *) form: add support for dynamic column re-layout when resizing window; *) form: allow mouse select a warning text; *) form: calculate window width of query panel by also considering table width; *) form: do not show table duplicates in enum shortcut/extras popup; *) form: fix autostart of some opened action windows; *) form: fix file picker field state update (changed/error); *) form: fix query panel getting data immediately if there is no start command; *) form: fix slow user interface when combobox has huge amount of dynamic data; *) form: fix some combobox sorting as requested by RouterOS; *) form: improve load performance if data contains large amount of multi-array rows; *) form: separate combobox visually and sort items separately from different enum sources; *) login,romon: fix connect in new window; *) login,romon: fix visual bug showing "Error: Object doesn't exist" while connecting to slow device; *) login,romon: show a clearer error when username/password wrong; *) login: download RouterOS index files sequentially to make login process more stable; *) login: select all text in "Connect To" field when opening WinBox; *) login: try to ignore all RouterOS WinBox file parsing errors and connect to RouterOS anyway; *) settings: change default row padding value from 4 to 3 (affects only new winbox installs); *) skins: fix crash when field references other fields from hidden table; *) table: add Ctrl(CMD)+E to enable and Ctrl(CMD)+Shift+E shortcuts to disable selected rows; *) table: add Insert and Ctrl(CMD)+N shortcuts to add new item; *) table: add support for cells with colored text by condition; *) table: add support to configure comment column/header type in each table; *) table: allow up/down keyboard navigation when there is no current row focus; *) table: correctly calculate default flags column width if there are combined flags; *) table: fix column sorting in rare cases; *) table: fix some buttons to be correctly under Actions group; *) table: hide live/pause button in Torch type windows (e.g. Profile/Ping) and Saved routers table; *) table: improve performance of table's quick filter with many records; *) table: improve performance when scrolling; *) table: remove selection/checkbox column; *) table: show field postfix in column header if available; *) terminal: add support for mouse scroll in script editor; *) terminal: fix Enter key located on Numpad for macOS; *) ui: add progress bar support for number based fields in form and table; *) ui: add settings info that table has end/home/pageup/pagedown shortcuts; *) ui: fix "Wireless Snooper" table cell values; *) ui: fix to show only 1 confirmation dialog if action performed on multiple items; *) ui: make form background a little lighter in light mode; *) ui: make popup background same as form in darkmode; *) ui: make workspace Name field read only after it is added; *) ui: scale context menu width according to zoom; *) ui: show info that RouterOS update is available; *) windows: update certificate for Windows executable signing; *) add new field type support used by future RouterOS version; *) update Documentation link in About window; Downloads macOS (universal) Linux (64-bit) Windows (64-bit) GPT 💬 ENG ESP POR УКР РУС 中文

RouterOS 7.21.5 [long-term] released! Critical!!!!) ppp - fixed CVE-2026-59108; Fixed: CVE-2026-59108 Changelog!) ppp - fixed CVE-2026-59108; *) bfd - fixed delay on session print; *) bgp - fixed advertisement print handling by "dst" when destination is in VRF; *) bgp - fixed IPv6 End-of-Route processing; *) bgp - improved stability on MP (multiprotocol) parsing; *) bridge - fixed dynamic VLAN update for wifi interfaces; *) bridge - fixed stability issue when using DHCPv4 snooping; *) cloud - cloud backup file management now requires "policy" policy; *) console - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal; *) container - fixed missing config.json issue when upgrading from version 7.20.8 or older; *) disk - avoid reading SCSI stats all the time to allow disks to go to sleep; *) ethernet - fixed stability issue with TSO on Alpine CPUs; *) ethernet - improved system stability on devices with Alpine CPUs; *) ipv6 - do not disable IPv6 FastPath when Traffic Flow is enabled; *) isis - allow to configure metric-type; *) isis - fixed missing "l2.lsp-refresh-interval" parameter; *) l3hw - improved system stability on device shutdown/reboot; *) lte - fixed cases where EC25-EU and EG25-G boards would receive packets with missing last 4 bytes; *) lte - fixed crash on LTE passthrough interface deactivation; *) ospf - fixed interface passive flag update in WinBox; *) route - fixed static route flag handling by WinBox on disable; *) route - removed deprecated "/routing/route/rule" menu; *) switch - fixed issue with MAC table for RB2011 (introduced in v7.21); *) switch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs; *) switch - increase "ingress-rate" and "egress-rate" maximum value to 400G; *) timezone - updated timezone information from "tzdata2026b" release; *) upgrade - prevent package scheduling from interfering with the upgrade feature; *) vxlan - fixed fast-path when using "checksum=no" (introduced in v7.20); *) winbox - do not pre-fill "Allowed Address" and "Client Allowed Address" with "::/0" when adding new WireGuard Peer; DownloadsMain: arm64 mipsbe mmips tile arm powerpc netinstall x86 x86-iso x86-dude x86-dude-client x86-netinstall64 x86-netinstall-cli btest.exe Extra: arm64 mipsbe mmips tile arm powerpc netinstall x86 Others: https://mikrotik.com/download GPT 💬 ENG ESP POR УКР РУС 中文

RouterOS 7.23.2 [stable] released! Critical!!!!) ppp - fixed CVE-2026-59108; Fixed: CVE-2026-59108 Changelog!) ppp - fixed CVE-2026-59108; *) app - fixed "reset" not working with certain apps; *) app - fixed home-assistant default config files; *) app - only generate secrets for enabled apps; *) app - resolved issue where duplicate swaps are created; *) bfd - fixed delay on session print; *) bgp - added option to add BGP VPLS created interfaces in interface-list; *) bgp - fixed advertisement print handling by "dst" when destination is in VRF; *) bgp - fixed IPv6 End-of-Route processing; *) bgp - improved stability on MP (multiprotocol) parsing; *) certificate - always use all trust stores for downloaded CRL validation; *) container - fixed missing config.json issue when upgrading from version 7.20.8 or older; *) interface - fixed duplicate MAC warning for wireless, wifi, macsec, w60g interfaces (introduced in v7.23); *) ipsec - fixed policy move handling; *) ipsec,ike2 - fixed active connection termination; *) ipsec,ike2 - fixed SA payload validation; *) ipsec,ike2 - improved pending child SA cleanup and removal of dangling SAs during Phase 2 deletion; *) isis - fixed missing "l2.lsp-refresh-interval" parameter; *) leds - fixed missing wireless LED configuration (introduced in v7.21); *) lte - fixed cases where EC25-EU and EG25-G boards would receive packets with missing last 4 bytes; *) ospf - added missing "type=ptmp-broadcast" parameter to "/routing/ospf/interface" menu; *) ospf - allow comments on static interfaces; *) ospf - fixed interface passive flag update in WinBox; *) pim - added comment for "/routing/gmp" entries; *) ppp - improved system stability; *) route - fixed static route flag handling by WinBox on disable; *) routerboard - renamed "ipq53xx" firmware type to "ipq5300"; *) switch - increase "ingress-rate" and "egress-rate" maximum value to 400G; *) upgrade - prevent package scheduling from interfering with the upgrade feature; *) winbox - added missing values to "AFI" setting under "Routing/BGP" menus; *) winbox - do not pre-fill "Allowed Address" and "Client Allowed Address" with "::/0" when adding new WireGuard Peer; *) winbox - fixed value unset under "MPLS/LDP Neighbor" menu; DownloadsMain: arm64 mipsbe mmips tile arm powerpc netinstall x86 x86-iso x86-dude x86-dude-client x86-netinstall64 x86-netinstall-cli btest.exe Extra: arm64 mipsbe mmips tile arm powerpc netinstall x86 Others: https://mikrotik.com/download GPT 💬 ENG ESP POR УКР РУС 中文

TG-LR82 & TG-LR92: Monitor Anything with LoRaWAN youtu.be/uc8HE-7piOs #YouTube channel: MikroTik 💬 ENG ESP POR УКР РУС 中文

GPOE-USB: power USB-C and 5 V DC devices from PoE! youtu.be/kX3pVF_dHxg #YouTube channel: MikroTik 💬 ENG ESP POR УКР РУС 中文

SXTsq Embedded LTE4: eSIM & affordable LTE ANYWHERE! youtu.be/jjIN6rSGAiQ #YouTube channel: MikroTik 💬 ENG ESP POR УКР РУС 中文

MikroTik switches with Dante youtu.be/2PHcWhfsFeM #YouTube channel: MikroTik 💬 ENG ESP POR УКР РУС 中文

RouterOS 7.23.1 [stable] released! Changelog*) app - fixed bogus configuration export; *) app - fixed making empty directories when running configuration export; *) bgp - fixed memory leak; *) bridge - fixed stability issue when using DHCPv4 snooping; *) disk - avoid reading SCSI stats all the time to allow disks to go to sleep; *) disk - improved error message when a swap file is created without "file-size" specified; *) ethernet - fixed stability issue with TSO on Alpine CPUs; *) firewall - improved system stability; *) ipsec,ike2 - improved TSi validation to prevent modecfg address conflicts; *) ipv6 - do not disable IPv6 FastPath when Traffic Flow is enabled; *) ospf - added missing interface parameters; *) ospf - fixed unresolved route problem when "routing-table" setting is used; *) ptp - rename "smpte" to "smpte-2059"; *) route - improved overall stability; *) route - removed deprecated "/routing/route/rule" menu; *) switch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs; DownloadsMain: arm64 mipsbe mmips tile arm powerpc netinstall x86 x86-iso x86-dude x86-dude-client x86-netinstall64 x86-netinstall-cli btest.exe Extra: arm64 mipsbe mmips tile arm powerpc netinstall x86 Others: https://mikrotik.com/download GPT 💬 ENG ESP POR УКР РУС 中文

MikroTik: CVE-2026-48695 FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin. The _log() function in src/mikrotik_plugin/fastnetmon_mikrotik.php (lines 107-108) constructs shell commands by concatenating the $msg parameter directly into exec() calls: exec("echo `date` \"- {FASTNETMON] - " . $msg . " \" >> " . $FILE_LOG_TMP). This is identical in pattern to the Juniper plugin vulnerability. The $msg variable contains unsanitized attack data from command-line arguments. An attacker who can influence argv[] values can inject arbitrary shell commands. The fix is to replace exec() with file_put_contents() or use escapeshellarg().

RouterOS 7.22.3 [stable] released! Changelog *) console - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal; *) ethernet - fixed stability issue after switch reset on devices with IPQ-40xx, IPQ-60xx CPUs (introduced in v7.22); *) vrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge for Marvell Prestera switch chip; Downloads Main: arm64 mipsbe mmips tile arm powerpc netinstall x86 x86-iso x86-dude x86-dude-client x86-netinstall64 x86-netinstall-cli btest.exe Extra: arm64 mipsbe mmips tile arm powerpc netinstall x86 Others: https://mikrotik.com/download GPT 💬 ENG ESP POR УКР РУС 中文