Mikrotik
RouterOS
See the latest tracked release, confirm when it was published, and subscribe for update emails.
7.24.2
- Release date
- September 03, 2026
- Security status
- Current version appears affected by 2 high-severity CVEs.
Source
Vendor Release Information
Public release notes are linked for the latest stored release.
Release history
See the latest published releases stored for this product.
| Version | Published | Notes |
|---|---|---|
| 7.24.2 | 2026-09-03 | Release Notes |
| 7.24.1 | 2026-08-24 | Release Notes |
| 7.24 | 2026-08-17 | Release Notes |
| 7.23.3 | 2026-08-03 | Release Notes |
| 7.23.2 | 2026-07-06 | Release Notes |
| 7.23.1 | 2026-06-03 | Release Notes |
| 7.23 | 2026-05-26 | Release Notes |
| 7.22.3 | 2026-05-08 | Release Notes |
| 7.22.2 | 2026-04-23 | Release Notes |
| 7.22.1 | 2026-03-24 | Release Notes |
Vulnerability tracking
versionPing monitors CVEs for this product. Matching CVEs are listed below. We only display CVEs with a CVSS score of 7.0 or higher that were published within the last 90 days.
Affected status is inferred from published affected version ranges where available. Always verify against the vendor advisory before making production decisions.
| CVE | Severity | Published | Status | Summary |
|---|---|---|---|---|
| CVE-2026-16347 | HIGH (8.7) | 2026-07-28 | Current versionaffected | MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services. Affected versions
|
| CVE-2023-30800 | HIGH (7.5) | 2023-09-07 | Current versionaffected | The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immediately restarted. The issue was fixed in RouterOS 6.49.10 stable. RouterOS version 7 is not affected. Affected versions
|