What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Update RouterOS to a fixed release as soon as practical: MikroTik lists 7.25beta3, 7.24.2, 7.23.4, and 6.49.21 as fixed versions, with later releases also covered. Choose the version for your device’s release branch and check MikroTik’s update channel. CISA’s Known Exploited Vulnerabilities catalog includes two of the three CVEs, according to Canada’s cyber security centre. MikroTik says most configurations are not at risk, but recommends upgrading.
Which RouterOS versions fix the September 2026 vulnerabilities?
MikroTik’s September 3, 2026 bulletin names CVE-2026-67276, CVE-2026-67277, and CVE-2026-86060, and lists these fixed releases: 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, or any later release. These are branch-specific release identifiers, not interchangeable minimums. Check the branch installed on your device and use the corresponding fixed release or a later one.
| RouterOS branch | Fixed release listed by MikroTik |
|---|---|
| 7.25 | 7.25beta3 |
| 7.24 | 7.24.2 |
| 7.23 | 7.23.4 |
| 6.49 | 6.49.21 |
Release channels and branch availability can change. Verify the current offered update for your device rather than assuming one version number applies to every RouterOS installation. The Canadian Centre for Cyber Security advisory also provides vendor-supported fixed versions by branch.
Why update promptly?
The Canadian Centre for Cyber Security reports that CISA added CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10, 2026. The September 14 MS-ISAC advisory reports that the vulnerability set is being exploited in the wild and says the most severe issue could allow full device control without authentication.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
- hEX also known as RB750Gr3 is a five port Gigabit Ethernet router for locations where wireless connectivity is not required
- The device has a full size USB port. This new updated revision of the hEX brings several improvements in performance
- It is affordable, small and easy to use, but at the same time comes with a very powerful dual core 880MHz CPU and 256MB RAM
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude
- Dimensions: 113x89x28mm; Storage size: 16 MB; Passive PoE (PoE in); PCB temperature monitor, Voltage monitor and Mode button
MikroTik’s bulletin says most configurations are not at risk and that regular home users do not face an immediate risk, while still recommending that all users upgrade. The vendor has withheld detailed technical information to allow time for updates. The cited advisories do not establish a CISA-assigned CVSS score, so “near maximum severity” should not be treated as a verified numeric rating or CISA characterization.
How to update a MikroTik router
- Open RouterOS and go to “Check for updates.” MikroTik says the device should offer the software upgrade there.
- Confirm the offered version matches your branch. Install the applicable fixed release from the table above or a later release offered for that branch.
- Apply the update and allow the device to complete it. Follow the device’s update prompts; do not interrupt the upgrade.
- Review the RouterOS logs after the update. Look for a critical entry indicating that the device is “Flagged.” If it appears, follow MikroTik’s Flagged-status instructions.
- Inspect the configuration. Check for unfamiliar scripts, users, or other settings, even if the logs do not show a flagged status.
Reduce exposure to remote management
MikroTik specifically advises ensuring that SSH is not open to untrusted networks. If remote access is necessary, restrict it to trusted IP addresses or use a strong VPN such as WireGuard rather than exposing management ports to the internet. These steps reduce exposure; they do not replace installing the fixed RouterOS release.
Rank #2
- Wired Gigabit Router – 5x Gigabit Ethernet ports, 2.5G SFP, PoE-Out, USB, powered by RouterOS
What the public advisories establish
The published material identifies the affected product family, the three CVEs, fixed releases, the reported KEV additions, and MikroTik’s mitigation guidance. MikroTik does not publicly detail the mechanics of all three vulnerabilities in its bulletin. MS-ISAC describes the potential impact of the most severe issue but does not, in the cited advisory, map that description to a specific CVE. Avoid assuming that each CVE has the same attack path or impact.
Quick Recap
Best Value
- W128339515
Rank #4
- MikroTik RouterBOARD C52iG-5HaxD2HaxD-TC-US (US Version) hAP ax (WiFi6) Quad-Core IPQ-6010 864 MHz, RAM 1GB, RouterOS, License level 4 It's time to supercharge your home network with the Generation
- hAP ax has everything you might need in a primary home access point - and more
- Forget endless reviews and comparisons - this is the perfect device for 99% of homes
- Wireless signal is now stronger than ever
- Here are the two main ingredients of hAP ax's success: a state-of-the-art dual-band, dual-chain 4-4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
