Remember to make backup/export files before an upgrade and save them on another storage device;
Make sure the device will not lose power during upgrade process;
Device has enough free storage space for all RouterOS packages to be downloaded.
What's new in 6.49.22 (2026-09-16):
system - improve stability (includes CVE-2026-67281);
To upgrade, click Check For Updates under System/Packages menu and select the long term Channel in RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download
Everything went smoothly
I encountered an issue after the update (please post about the device, configuration, and unexpected symptoms)
I encountered an issue, but solved it (please post the solution)
0voters
If you experience version related issues, then please send supout file from your router to support@mikrotik.com. The file must be generated while a router is not working as suspected or after some problem has appeared on the device
Please keep this forum topic strictly related to this particular RouterOS release.
Since the 3rd, there have already been four releases for the long-term chain.
And all these security issues were already known back on the 3rd.
And now we’re getting another release?
If I understand correctly...
There are still active vulnerabilities right now that could be exploited if not contained.
And back on the 3rd—when the first fix was released—they already knew about all these vulnerabilities and how to fix them.
What was missing was organization and internal communication—someone with a bit more composure to hold off and release a fix a day or two later that addressed everything at once.
Is that right?
I hope the question was not for me as I do not know. I read the CVE but I find the info strange as it only discuss V7 and this CVE number is not patched in V7 yet so either the CVE is wrong or we will soon see a patch in V7 as well.
Regardless I think the takeaway here should be proctect you admin interfaces on your devices. Do not expose webfig, winbox or anything like this on internet unless you have a protection lay ontop.
Also prepare youself for more pacthes as AI code check will for sure create more patches in the future but sooner or later they will also die out but before that the road will be bumpy so if you want to patch less in the future protect your admin interfaces
it was fixed in 7.23.4 in the big bunch, but since mikrotik is lying about it, people are confused.
Btw - they first announced it was fixed in 6.49.21 and 7.23.4, then they changed it to "ROS 7.x affected only" and then - voila, 6.49.22 went out, fixing exactly this.
The communication, or better say miscommunication about this from Mikrotik is terrible
Was the vulnerability resolved in 6.49.21 or is 6.49.22 required to completely mitigate the vulnerability?
The CVE listing shows that 6.x was not impacted, yet the email stated to patch to 6.49.21 and now this is stating it resolves a CVE for 6.x which the CVE states it does not apply. Do we need to patch again from 6.49.21 to 6.49.22 to ensure we are protected? Our management isn't publicly accessible, the concern is any other compromise could leverage this CVE to access the firewall from an internal interface.
MikroTik addressed the flaw in RouterOS 7.23.4 (Long-term) and 7.24.2 (Stable). Release details are published in the 7.23.4 release notes and 7.24.2 release notes. No fix is available for the 6.x branch because it is not affected.
6.48.7 - > 6.49.22 Migration update (~1000 devices):
Currently, two of my smaller municipalities, spanning the entire chain from edge BGP to CPEs,
have been updated to version 6.49.22,
not a single CPE or device was lost,
and everything is currently working just as before.
There remains only one device that was corrupted (not hacked),
it has been restored and is functioning without issues.
For those wondering: Yes, this is the prelude to moving to 7.23.x.
Of around ~650 devices upgraded still running v6 the most problematic have been found to be the Cube Pro 60G, in the region of 1-2% are not responsive after upgrading. The ethernet link comes up but no packets are received from them until the power is cycled which is annoying where they are fed from injectors rather than managed switches.
6.48.7 - > 6.49.22 Migration update:
Now I reach ~3000 updated devices and all is smooth.
I am more or less a one third of the way through upgrading the entire network.
Including various machines handling BGP v4 and v6,
machines running The Dude,
and others with User-Manager.
Now only the CPEs are left: the main devices are all updated.
I’m in a location that sees a lot of tourist customers.
There are 2,000 / 3,000 customers who only arrive in the summer, and for now,
I have to wait for the CPEs and customers APs to be turned back on so the update can start.
The recovered device for NAND/XOR corruption now are 3.
No hacked, just RouterOS file errors.
As an update, I just have to add that I updated another thousand devices today.
Only one acted up right after restarting, but after another reboot, everything seems normal now.
The 60ad devices (LHG 60G, Cube 60G and wAP 60G) are fine, having upgraded 390 of them multiple times over several years. It is the 60ay Cube Pro 60G which I have found to be problematic with a different few of 280 requiring a power cycle to restore connectivity after upgrading.
Thanks again for the information,
but those two are the only 60GHz MikroTik models currently in production.
I have the other models here... decommissioned...
I must have updated around 8,000 devices: I lost count at some point. NO-SINGLE-LOSS
I’ll update the offline CPEs (belonging to customers who aren't home) once they are powered on.
As for the rest, there is nothing to add to what has already been written.
My entire network is now running at least version 6.49.22,
except for a few devices on 7.23.7 ​​because v6 couldn't be installed on them (CHRs for GPONs).
Inside the customers' homes (so, excluding the CPEs), everything is on 7.23.7 on ax devices.
Regarding 7.23.7, the migration from 6.49.22 to 7.23.7 of all devices ​​will begin in two weeks,
and I will report my findings in the dedicated Topic for 7.23.7.
