Before an upgrade:
Remember to make backup/export files before an upgrade and save them on another storage device;
Make sure the device will not lose power during upgrade process;
Device has enough free storage space for all RouterOS packages to be downloaded.
What's new in 7.26beta4 (2026-10-27):
- app - add remove-certificate command for certificates not used by any app;
- bgp - improve update processing performance when multiple peers are used;
- bonding - add lacp-strict setting for 802.3ad bonds;
- bridge - fix incorrect root-path-cost calculation in MLAG when the root bridge is on a single-connected port;
- bridge - fix loop-protect not working when a VLAN interface is added to the bridge (additional fixes);
- certificate - add option for pasting certificate in PEM format in add and import commands;
- certificate - fix CRL download failing when the server responds with an HTTP 3xx code;
- certificate - fix empty error message when ACME DNS validation times out;
- certificate - fix services continuing to use the previous certificate after ACME renewal;
- cmr - fix configuration display not showing effective values for unset fields;
- cmr - fix VLAN rules being applied to all ports when port-labels is not set;
- cmr - improve stability;
- cmr - replace dashboard value bars with grouped bar graphs;
- cmr - require write policy to run the alert test command;
- console - fix custom SSH client login parameters being ignored (introduced in v7.26beta1);
- console - fix deprecated argument names not being readable with get and proplist;
- console - improve stability;
- disk - fix NFS clients being served the wrong export after a reboot;
- ethernet - disable EEE on RB4011, RB1100AHx4, L009, L11, L23 devices;
- ethernet - do not allow adding duplicate RPS interface entries;
- ethernet - fix broadcast traffic still reaching the CPU when port isolation is used on Atheros and MediaTek switches (additional fixes);
- iot - fix LoRa channel configuration changes failing with a validation error;
- ipsec - fix XFRM interfaces staying down until a reboot;
- ipv6 - fix from-pool address lifetimes not updating after a prefix renewal (introduced in v7.25);
- l3hw - improve stability on CRS8xx series switches;
- log - fix logging actions with target=script not running the script after a reboot;
- lte - fix eSIM provisioning from the mobile app (introduced in v7.26beta1);
- lte - fix Telit LE910C4-WWX modem serial driver not binding at cold boot;
- lte - fix traffic not passing with multiple locally terminated APNs for R11e-4G modem;
- lte - reduce eSIM pending notification send retry count to 2;
- netwatch - fix check-certificate not working for HTTPS-GET probes;
- netwatch - fix wrong checksum in the first ICMP echo of a test on TILE devices;
- poe-out - fix missing status column in print output;
- ppp - fix BG770A modem not initializing after a firmware upgrade until a reboot;
- route - add RPKI ASPA validation support;
- route - fix routing memory statistics missing some memory pools;
- sfp - fix DAC EEPROM corruption when disabling 400G ports on CRS804 and CRS812 switches;
- socks - fix comments not being saved;
- ssh - refactor SSH internal processes;
- switch - add a high-priority CPU queue for control traffic on Marvell Prestera switches;
- switch - fix CPU-sent VLAN-tagged packets with the DEI bit being dropped on Marvell Prestera switches;
- system - improve stability;
- tr069 - add nodes for GPS information;
- usb - add overcurrent monitoring and per-port power cycle for hAP be3 Media;
- user-manager - fix database not opening after reboot when db-path is several directories below the mount point;
- webfig - fix missing default values for CMR label fields;
- webfig - fix the Power Cycle action not working;
- wifi - fix virtual interface restart loop when reselect-interval and reselect-time are configured (introduced in v7.25);
- wifi - initial easymesh controller and agent implementation (CLI only);
- wifi-qcom-be - fix station mode not connecting when limited to an older standard than the AP;
- wifi-qcom-be - fix station not connecting when limited to narrower channel than AP;
- winbox - allow adding LTE interfaces with a master interface and APN profile (additional fixes);
- winbox - make RPS menu configureable;
What's new in 7.26beta3 (2026-10-16):
- apptraffic - fix connection tracking not reverting to auto when apptraffic is disabled;
- bridge - add dhcp-snooping-option82-policy setting for handling packets that already carry option 82;
- bridge - add topology-change, host-moves and STP timer statistics to monitors;
- bridge - fix fragmented IPv6 traffic being dropped by DHCPv6 snooping (introduced in v7.23);
- bridge - fix static host entries being aged out of the hardware table;
- bth - fix allow-uploads being settable on shares that point to a file;
- cmr - add low-voltage-pd-detected poe status;
- cmr - add user attribution to log entries;
- cmr - allow using the WiFi SSID as an automatic label;
- cmr - do not create alert conditions when rebooted=no or unpaired-device-connected=no;
- cmr - fix channel width report for wifi stations;
- cmr - fix device identity changes not syncing with the server;
- cmr - fix failed upgrade alerts showing an incorrect version;
- cmr - fix layout node coordinates displayed incorrectly when negative;
- cmr - fix manual upgrade to a pinned version;
- cmr - fix missing application counters in the apptraffic view;
- cmr - fix missing device export command;
- cmr - fix pairing password requirement changes not being detected;
- cmr - fix pairing state after a failed password pairing;
- cmr - fix setting port-labels for multiple ports from the CLI;
- cmr - fix the first interface-change alert not firing;
- cmr - fix upgrade "show-devices" listing non-paired devices;
- cmr - fix wifi-logs showing entries from unselected devices;
- console - fix /cmr configuration missing from the export;
- console - improve stability;
- container - add label support;
- defconf - disable FTP and Telnet services;
- defconf - fix boot device selection after configuration reset with keep-apps=yes;
- discovery - do not send LLDP power requests before the default configuration is applied;
- disk - fix all-zero NGUIDs on NVMe over TCP exported namespaces;
- disk - fix newly formatted Btrfs disks failing to mount (introduced in v7.26beta1);
- dot1x - fix MACsec not working between ARM and MIPS devices;
- dude - replace dude 32-bit client with 64-bit version;
- ethernet - fix broadcast traffic still reaching the CPU when port isolation is used on Atheros and MediaTek switches;
- ethernet - fix occasional packet loss on hAP be Media;
- ethernet - fix spurious duplicate MAC address warning on WDS interfaces;
- evpn - fix MAC-IP route origination and withdrawal (introduced in v7.25);
- iot - fix LoRa gateway packet validation when transmitting;
- ipsec - fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21);
- ipsec - fix policies not being loaded after an upgrade (introduced in v7.25);
- l3hw - add VXLAN offloading to CRS8xx series switches;
- l3hw - fix hardware offload for active-backup bonds;
- l3hw - fix hardware offload for VLAN interfaces created directly on Ethernet ports on CRS8xx series switches;
- l3hw - fix offload issues on ECMP routes with non-offloadable paths;
- l3hw - fix packet loss when a directly connected host moves from a bond to Ethernet;
- l3hw - gate L3 hardware offload by the port's L2 hardware offload state;
- l3hw - stop forwarding packets through an unreachable nexthop;
- lcd - improve stability when changing the color scheme after touchscreen recalibration;
- leds - fix Audience front LED when wifi is managed by wifi-qcom-ac;
- log - fix the default flag not being shown for the default configuration log rules;
- lte - clear the cached eSIM profile list after a SIM change;
- lte - fix dialer for D-Link DWM-222W modems (additional fixes);
- lte - fix iOS tethering not obtaining an IP address;
- lte - fix linkup only after link-recovery-timer after firmware-upgrade on RG650E-EU modem;
- lte - fix packet loss with R11e-LTE-US modems (introduced in v7.21);
- lte - fix QMI modems waiting out the full link-recovery-timer after re-attaching;
- lte - fix Telit LE910C4-WWX modem not initializing after a cold boot;
- lte - improve modem firmware-upgrade for EG800K-EU modem;
- lte - improve stability for devices with QMI modems;
- lte - keep the "auto" MTU option on LTE interface after reboot (additional fixes);
- lte - prevent removing an APN profile that is still in use by inactive interfaces;
- mpls - fix dynamic-label-range rejecting a valid 1024-label range;
- netinstall - add force stop for in-progress installations;
- netwatch - improve stability when deleting https-get probes;
- poe-out - fix export not showing the configuration under the poe submenu;
- poe-out - fix poe-in voltage monitoring and LLDP power requests on hEX S (2025) devices;
- routing-filter - fix any-regexp community matcher matching an empty community attribute;
- routing-filter - fix community delete, filter and modify with regexp-only community lists;
- sfp - fix host link breaking on S+RJ10 modules when changing advertised modes;
- sfp - improve link stability for QSFP28 breakout ports to prevent interface lane flapping when one lane goes offline;
- sniffer - fix long-running captures failing after approximately 4.3 billion packets;
- snmp - add ospfAdminStat and ospfRouterId to the OSPF MIB;
- ssh - fix a failed command returning a successful exit status;
- switch - fix egress rate limiting with jumbo frames on Marvell Prestera switches;
- switch - fix link flapping on QSFP cage ports when connecting to NVIDIA DGX Spark;
- switch - fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches;
- switch - improve SFP/QSFP auto-negotiation on CRS8xx series switches;
- system - fix interface statistics for third-party monitoring tools;
- system - improve stability;
- tls - add Renegotiation Indication Extension support;
- traffic-flow - add post-NAT IPv6 addresses to NetFlow records;
- traffic-flow - fix CPU usage being classified as networking in the profiler;
- webfig - add on-demand loading of directory contents in the Files menu;
- webfig - fix static IPv6 addresses showing wrong lifetime values;
- webfig - improve network topology view performance;
- wifi - add station-bridge and station-pseudobridge mode support for MLO stations;
- wifi - fix client isolation assigned via RADIUS being lost after roaming;
- wifi - improve stability when disabling an AP with multiple connected stations;
- wifi - initial MLO station mode support on 802.11be devices;
- wifi - make station interfaces compatible with access points that do not retransmit EAPoL message 1;
- wifi-mediatek - fix roaming between APs belonging to the same MLO group;
- wifi-mediatek - improve stability when MLO stations connect;
- wifi-mediatek - update radio regulatory information;
- wifi-mediatek - update the wireless driver and firmware (additional fixes);
- wifi-qcom-ac - fix traffic being sent to the wrong station after a station-bridge roams between APs;
- winbox - add a comment field to the DNS adlist window;
- winbox - add the default-country parameter to wifi radio settings;
- winbox - add wpa3-psk-gd to wifi security profile authentication types;
- winbox - add ZeroTier controller, member and peer hint settings;
- winbox - allow adding LTE interfaces with a master interface and APN profile;
- winbox - display the "forced-on-bt" PoE-out mode set from the CLI;
- winbox - fix bridge filter window disabling valid fields for IPv6 rules;
- winbox - fix wifi radio band selection not being available in radio settings;
- winbox - hide ACL rule counter tools and graphs on non-Prestera switches;
- winbox - rename last-member-interval to last-member-query-interval;
- wireguard - ignore disabled peers when checking for duplicate Allowed Addresses;
- www - fix REST API login for users with rest-api policy, but without api policy;
What's new in 7.26beta1 (2026-10-01):
- bridge - add a per-VLAN DHCP snooping option;
- bridge - fix loop-protect not working when a VLAN interface is added to the bridge;
- bridge - show if bridge port is blocked by dot1x;
- bridge - store hw option for disabled bridge ports;
- cmr - add initial implementation of centralised platform for RouterOS devices, allowing updates, monitoring, alerts and other options;
- console - improve stability;
- container - add /app menu to ARM32 devices;
- crypto - improve ECDSA and EdDSA key and signature validation;
- dhcpv4-client - improve stability when the interface is deactivated while the client broadcasts a DHCP release;
- dhcpv6-server - add a dns-none option to not include DNS options in responses;
- dhcpv6-server - fix a DHCPv6 server failure when the RADIUS reply contains an empty delegated IPv6 prefix;
- dns - improve service stability on HTTP/2 DoH connections;
- ethernet - improve stability on devices with Intel I226-V network controllers;
- ethernet - move the port bandwidth setting to the switch port menu;
- files - improve stability when moving directories to external storage;
- interface - show if interface is blocked by stp or dot1x;
- ipsec - fix IPsec tunnels failing after migration from the old QKD settings;
- ipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder;
- l3hw - add VRRP hardware offloading support;
- log - add the container name to CEF logs;
- lte - do not reconfigure if not RouterOS activated CID is deactivated for R11l-LTE7 modem;
- lte - fix dialer for D-Link DWM-222W modems;
- lte - fix IPv6 route not being added on modems that do not report a gateway via control interface;
- lte - fix modem firmware-upgrade failing when SMS polling is enabled;
- lte - fix multi-APN passthrough stopping when one APN fails to connect;
- lte - fix multi-APN passthrough stopping when one passthrough-interface VLAN is down on the CPE in multi passthrough interface setup;
- lte - fix passthrough cleanup when the lte link goes down for QMI modems;
- lte - fix recurring LTE disconnects R11e-LTE-US modem and some Sierra modems;
- lte - keep the "auto" MTU option on LTE interface after reboot;
- lte - reworked multi-apn support. Added support for slave APN interface add/remove;
- netinstall - install the package version of the configured update channel;
- ovpn - improve stability in UDP Ethernet mode when the TX queue is full;
- pim - fix a routing process failure when the hello-delay is set to 0;
- ptp - fix PTP not working on a VLAN-aware bridge when IGMP snooping is enabled;
- qos - fix per-queue counters after a switch restart (introduced in v7.23);
- quickset - fix the WAN interface being selected incorrectly;
- reverse-proxy - fix setting the VRF parameter for reverse-proxy rules via CLI;
- switch - add interface-list support to port isolation;
- switch - fix high CPU usage when removing switch VLANs on Atheros-based switch chips;
- switch - fix switch rules not working on Atheros-based switch chips;
- switch - fix switch rules port matchers not working on IPv6 traffic on Atheros-based switch chips;
- switch - fix switch rules with rate limits stopping traffic on CRS3xx devices;
- switch - improve stability on CRS326-24S+2Q+ devices;
- system - improve stability;
- system - stop the flash configuration store from growing on dynamic configuration changes;
- webfig - add conditional coloring of cells in tables;
- wifi - add a default-country parameter in radio settings (CLI only);
- wifi - fix WPA3 SAE authentication issue for ECC group 21 (introduced in 7.24.3);
- wifi - implement channel.reselect-interval feature for missing drivers;
- wifi - reuse freed station association IDs;
- wifi-mediatek - update the wireless driver and firmware;
- wifi-qcom - fix antenna gain setting not affecting transmit power (introduced in v7.24);
- winbox - add the interface column to the OSPF neighbor list;
- winbox - rename "minimum-version" to "minimum-firmware" under "System/RouterBOARD" menu;
- winbox - show warning messages under "System/Users/SSH Keys" and "System/Users/SSH Private Keys" menu;
- wireguard - do not show an interface as running when it has no peers;
- wireguard - fix a client-dns value that could not be removed in WinBox;
- wireguard - fix a peer that would not work after import when no endpoint address is set;
To upgrade, click Check For Updates under System/Packages menu and select the testing Channel in RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download
- Everything went smoothly
- I encountered an issue after the update (please post about the device, configuration, and unexpected symptoms)a
- I encountered an issue, but solved it (please post the solution)
0
voters
If you experience version related issues, then please send supout file from your router to support@mikrotik.com. The file must be generated while a router is not working as suspected or after some problem has appeared on the device
Please keep this forum topic strictly related to this particular RouterOS release.
Metadata says "CMR server", so this is a service you only install once in your network and can manage other devices. Right?
(just kidding!)
"I like Winbox 4" if is it the price...