RouterOS ↗

MikroTik · Actively exploited

Track your version:Monitors RouterOS and tailors your dashboard to that exact version.

7.25 · latest cycle97/100 Healthy

Auto-added after CISA flagged RouterOS as actively exploited (KEV catalog). Version and lifecycle mapping is pending review, so this is assessed at the product level and is never reported as a confident "healthy".

Summary iPlain-English security verdict for RouterOS, generated from its current health score, actively-exploited vulnerabilities, and latest supported version.

RouterOS currently scores 97/100 — healthy. 5 actively-exploited vulnerabilities (CISA KEV) affect older releases (e.g. CVE-2018-14847) — staying on the latest supported version keeps you clear of them. The latest supported release is 7.25. It's on the latest patch with no significant known issues — keep it current.

Disclosure trend iNew CVEs published for RouterOS each year (NVD). A higher bar means more disclosures that year — more scrutiny, not necessarily less safe.

'19

'20

'21

'22

'23

'24

'25

'26

Patch priority — what to act on iThe issues to fix first — actively exploited (CISA KEV) first, then by exploitation probability (EPSS), then severity. Each row's "→ fixed in" is the earliest version that patches it; "see advisory" means no fixed version is published.

Most urgent first — actively exploited, then likeliest to be exploited.

CVE-2018-14847 CRITICAL exploited Path traversal EPSS 96% → see advisory CVE-2018-7445 CRITICAL exploited Memory corruption EPSS 66% → fixed in 6.41.3 CVE-2026-86060 CRITICAL exploited CWE-88 EPSS 6% → fixed in 7.24.2 CVE-2026-67279 MEDIUM exploited CWE-841 EPSS 2% → fixed in 7.24.2 CVE-2026-67277 HIGH exploited Missing authentication EPSS 2% → fixed in 7.24.2 CVE-2017-20149 CRITICAL Out-of-bounds write EPSS 2% → fixed in 6.38.5 CVE-2022-34960 CRITICAL CWE-59 EPSS 2% → see advisory CVE-2023-30799 CRITICAL Improper privilege management EPSS 1% → fixed in 6.49.7 CVE-2026-67278 CRITICAL CWE-347 EPSS 0% → fixed in 7.24.3

See all 87 known RouterOS CVEs & security history →

Get alerted about RouterOS

Be emailed the moment RouterOS gets a newly exploited vulnerability (CISA KEV) or a release reaches end of life. Free · double opt-in · unsubscribe anytime.

We email only on real events for RouterOS — no marketing, no sharing, and we never know what you run. Track your whole stack →

Versions & lifecycle iWhen each release line stops receiving security patches (end-of-life). After EOL there are no more fixes — plan upgrades before these dates.

How long each RouterOS release line is supported — and when it sunsets. Select a line for its full report.

Oct23'26 RouterOS 7.24ended 2026-10-23

May26'26 RouterOS 7.22ended 2026-05-26

May26'26 RouterOS 7.21ended 2026-05-26

Jan12'26 RouterOS 7.20ended 2026-01-12

Sept30'25 RouterOS 7.19ended 2025-09-30

May22'25 RouterOS 7.18ended 2025-05-22

Feb24'25 RouterOS 7.17ended 2025-02-24

Jan16'25 RouterOS 7.16ended 2025-01-16

Sept24'24 RouterOS 7.15ended 2024-09-24

May30'24 RouterOS 7.14ended 2024-05-30

Mar25'24 RouterOS 7.13ended 2024-03-25

Dec14'23 RouterOS 7.12ended 2023-12-14

Full RouterOS end-of-life dates & support timeline →

Frequently asked

Is RouterOS safe and patched?

What should I do about RouterOS now?

Upgrade RouterOS to the latest supported release (7.25) or later, which clears the actively-exploited issues affecting older versions, then confirm against MikroTik's official advisory.

Why is RouterOS listed on IsItPatched?

RouterOS was added automatically because CISA's Known Exploited Vulnerabilities (KEV) catalog flagged it as actively exploited in the wild. IsItPatched tracks its known CVEs, severity (CVSS), exploitation probability (EPSS) and KEV status from public data; its version and lifecycle mapping is verified over time.

Has RouterOS been actively exploited?

Yes. CISA added RouterOS to its Known Exploited Vulnerabilities (KEV) catalog after confirming exploitation in the wild — the triggering vulnerability is CVE-2018-7445. Make sure you are running a patched, supported version of RouterOS and confirm it against MikroTik's security advisory.

When does RouterOS reach end-of-life?

The latest supported RouterOS release is 7.25. After end-of-life a release no longer receives security patches.

Which versions of RouterOS are still receiving security updates?

Supported RouterOS release lines (latest 7.25): 7.25, 7.23, 6.49. End-of-life releases no longer receive security patches.

Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against MikroTik's official advisory before you patch or upgrade — RouterOS official site ↗