Before an upgrade:
- Remember to make backup/export files before an upgrade and save them on another storage device;
- Make sure the device will not lose power during upgrade process;
- Device has enough free storage space for all RouterOS packages to be downloaded.
What's new in 7.23rc3 (2026-May-06 19:26):
- console - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal;
- discovery - added separate read-only menu "/ip/neighbor/lldp" for neighbors discovered by the LLDP (CLI only) (additional fixes);
- ethernet - fixed stability issue after switch reset on devices with IPQ-40xx, IPQ-60xx CPUs (introduced in v7.22);
- ip - added IPv6 and VRF support for reverse-proxy;
- netwatch - fixed memory leak when using HTTP/HTTPS GET probe with invalid src-address;
- sniffer - fixed missing VLAN tag in the TZSP packets (additional fixes);
- system - improved switching to HTTP/1 if HTTP/2 is not supported by remote host;
- upgrade - added the option to configure HTTP/HTTPS modes when connecting to MikroTik upgrade servers (additional fixes);
- vrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge for Marvell Prestera switch chip;
- wifi - improved interface provisioning for WiFi 7 access points;
What's new in 7.23rc2 (2026-Apr-21 18:18):
- app - fixed birdnet-go, cryptpad, lorawan-stack, mikrodash (introduced in v7.23beta5);
- ethernet - fixed false excessive broadcast warning (introduced in v7.20);
- ipsec – fixed expired SA handling to prevent “no such item” errors during listing;
- lte - fixed AT modem dialer command timeout (introduced in v7.23beta5);
- lte - fixed operator setting for QMI modems;
- poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
- poe-out - fixed occasional detection issue when using auto-on mode;
- route - revert to old routing rule priorities for containers (introduced in v7.22);
- sniffer - fixed missing VLAN tag in the TZSP packets (additional fixes);
- system - improved system stability;
- wifi-mediatek - fixed stability issue getting regulatory information and during initialization;
- wifi-qcom-be - fixed stability issue during initialization;
- www - improved service stability when cancelling REST API sessions;
What's new in 7.23rc1 (2026-Apr-14 14:35):
- app - check if certificate already exists before creating a new one;
- app - fixed some apps not containing the full repository URL;
- app - fixed store issue when adding a custom app;
- bridge - synchronize only local bridge MAC addresses for MLAG (introduced in v7.22);
- certificate - added option to configure built-in trust store for all services (additional fixes);
- certificate - allow deleting ACME certificate that failed to generate;
- certificate - improved ACME logging;
- certificate - improved ACME status reporting;
- certificate - set Let's Encrypt as default ACME directory;
- container - check if root-dir does not exist before adding a container;
- discovery - added "add-dns-entries" and "add-dns-entries-suffix" properties for creating local DNS entries (additional fixes);
- discovery - added option to disable/enable LLDP MED (additional fixes);
- firewall - improved system stability (additional fixes);
- interface - show warning when same MAC address is used on more than one virtual interface (additional fixes);
- ipsec - improved NAT encapsulation parameter forwarding;
- isis - improved stability with fragmented CSNP;
- leds - fixed default LED configuration for CCR2004-1G-12S+2XS;
- leds - fixed LED dark mode for RB5009;
- log - added "discover" topic and log events for discovered local DNS entries;
- lte - delete CID profiles one by one instead of "delete all" for QMI modems, as command does not work for all modems;
- ospf - allow adding interface configuration manually, bypassing interface-template (additional fixes);
- ospf - improved stability on configuration change;
- switch - improved FDB operations on QCA8337, Atheros8327 (additional fixes);
- system - improved handling of HTTP/2 connection closure;
- system - improved RouterOS package download over slow connection;
- usb - fixed crash when using Ethernet adapter (introduced in v7.22);
- user-manager - improved stability when removing user-profile while session updates counters;
- vrrp - fixed packet drop in CHR (introduced in v7.22);
- vxlan - improved system stability;
- wifi-mediatek - fixed communication issues on 802.11ax access points with Intel clients;
- zerotier - switch to 1.14.2 version, fixed multipath (introduced in v7.23beta2);
Other changes since v7.22:
- app - added birdnet-go, cryptpad, diagrams-net, metube, nextcloud-whiteboard, paperless-ngx, wbo, zulip apps;
- app - added docker-with-dockge, docker-with-komodo, docker-with-portainer, HA-otbr-matter, odoo, otbr, stalwart apps;
- app - added lorawan-stack, mikrodash, trip apps;
- app - added possibility to set app command-line parameter from CLI;
- app - added restart command;
- app - allow apps on xfs file system;
- app - allow filtering by installed apps;
- app - allow overriding default stop signal;
- app - allow parsing DNS in YAML;
- app - allow passing stop signal from YAML and passing it to container as default;
- app - allow picking app category from drop-down;
- app - allow updating name parameter from YAML for custom apps;
- app - allow updating YAML for existing custom app, forces cleanup;
- app - apps now check for port availability, apps will not start on "internal" if app masks existing service;
- app - automatically pass any required devices to container, such as otbr;
- app - automatically restart app when required hardware device is changed;
- app - bundled ollama with openwebui;
- app - disabled PiHole syncing NTP to host;
- app - fixed issue where XFS disks did not appear in the app disk drop-down;
- app - fixed potential crash when running cleanup on a lot of apps;
- app - fixed saving custom apps;
- app - fixed showing ui-url for apps;
- app - fixed uptime-kuma and jupyter-notebook;
- app - fixed YAML not exported for custom apps;
- app - improved app networks and port behavior;
- app - improved automatic hardware device passing to container;
- app - improved YAML error message;
- app - make sure all layer .tar.gz files are deleted after extraction finishes;
- app - on file based devices, swap is enabled on the file itself instead of creating another one and enabling it on that;
- app - stability fixes for the "/app" menu;
- app - swap file is now created based on the mount-point it is attached to;
- app - updated uptime-kuma image;
- arm64,x86 - updated Broadcom bnxt Ethernet driver for 200G support;
- bfd - fixed source address selection for IPv6 multihop sessions;
- bgp - fixed stability issue when nonexistent output select-chain was specified;
- bridge - added ability to set custom Option 82 with dhcp-agent-circuit-id, dhcp-agent-remote-id settings (replaces add-dhcp-option82 setting; configuration is automatically updated after upgrade);
- bridge - added DHCPv6 snooping feature with ability to set custom Option 18 and Option 37;
- bridge - fixed missing dynamic "switch-cpu" VLAN entry in WiFi setup;
- bridge - improved MAC synchronization for MLAG;
- bridge - recognize more DHCP message types when dhcp-snooping is enabled;
- bth - fixed WireGuard client config IP address netmask;
- certificate - added "ISRG Root X1" and "DigiCert Global Root G2" to SMIPS built-in root certificate authorities store;
- chr - improved guest tool config for arm64 CHR;
- cloud - show error if cloud services are not supported on the device;
- console - added comment in "/ip/dhcp-server/option/sets" and "/ipv6/dhcp-server/option/sets" menus;
- console - added path parameter to export;
- console - added syntax highlight for script properties in some menus (e.g. dhcp-client, dhcp-server, ppp/profile, interface/vrrp);
- console - export mentions custom defconf script presence in header;
- console - fixed "/log/print follow on-event" to work with "where" (introduced in v7.22);
- console - fixed output when oversized completion present;
- console - removed redundant keepalive for the serial-terminal, ensure that the device no longer periodically outputs /0 while using "/system/serial-terminal";
- console - rename "cpu-used-per-cpu" to "cpe-used-per-core" in "/system/resource/monitor";
- console - show "/system/resource/hardware/usb-power-reset" only on x86;
- console - show warning in print header when terminal is too narrow to show any columns;
- console - treat non-existent command parameters as runtime errors;
- container - added restart-policy=no/always/on-failure, stop-on-unhealthy, restart-count, restart-interval, restart-max-count properties;
- container - added support for noexec option to mounts;
- container - added support for USB audio devices for containers;
- container - allow disabling individual container environment variables without deleting them;
- container - allow picking mount source directories with the file picker in WinBox;
- container - allow setting memory-max global and per container;
- container - allow user-defined mounts overriding /sys and /dev;
- container - clean up layers of non-existing containers;
- container - detect and show containers killed by out-of-memory killer;
- container - do not allow starting container/shell with non-existing user or group;
- container - draw graphs in container stats;
- container - fixed container entrypoint and shell override by user;
- container - fixed container layer size calculation;
- container - fixed container shell not working with multi-arg commands;
- container - fixed losing container after reboot;
- container - fixed repull if root-dir of container was in tmpfs;
- container - fixed running "/container shell" with the correct user, if container user is set or overridden;
- container - improved errors at container start;
- container - improved running container instance memory usage;
- container - layers are now accessible under "Layers" tab;
- container - pass any container startup error message back to "run" and make it exit immediately;
- container - remove container backup directory if import fails;
- container - removed "Layers" button;
- container - show container size and container data size;
- container - show default DNS servers;
- container - show layer size calculation status;
- crypto - fixed fallback flag loss in qcrypto;
- crypto - improved safexcel driver with upstream changes and patches;
- dhcpv4-server - added "add-dns" and "add-dns-suffix" properties for creating local DNS entries;
- dhcpv4-server - changed lease agent-circuit-id and agent-remote-id format to HEX;
- dhcpv4-server - do not raise an alert when receiving a packet originating from the same device;
- dhcpv4-server - do not suggest bogus pools when using setup command (e.g. when address is /31 or /32);
- dhcpv4-server - fixed an issue where renew packets without giaddr were sometimes not processed;
- discovery - added separate read-only menu "/ip/neighbor/lldp" for neighbors discovered by LLDP the (CLI only);
- discovery - dynamically update advertised "interface-name";
- discovery - fixed LLDP MAC/PHY TLV;
- disk - added "/disk" smart-info;
- disk - added disk check and repair for ext4, btrfs and xfs file systems;
- disk - improved device name tracking in "/system/resource/hardware" menu;
- disk - show disk io errors in "/disk" menu;
- disk - use USB UASP interface for supported devices;
- dns - added HTTP/2 support to DoH on ARM64 and x86/CHR devices;
- ethernet - improved system stability for RB3011, L009, NetMetal ax, hAP ax lite devices;
- ethernet - improved system stability on devices with Alpine CPUs;
- fetch - fixed non-working idle-timeout in some cases;
- file - added copy, tail, head commands (CLI only);
- firewall - improved stability for SIP helper;
- graphing - improved service stability when storing data;
- hardware - report the correct state of PCI devices in "/system/resource/hardware" menu;
- health - hide health menu for RB951ui-2nD;
- iot - added LoRa Tx delay setting;
- iot - added MQTT subscribe message real-time monitoring option;
- iot - added Wiliot support;
- iot - fixed LoRa LBT issues, which caused Tx packets not getting delivered;
- iot - improved LoRa stability;
- iot - improved LoRa Tx handling;
- iot - improved LoRa Tx scheduling;
- ip - added SNI logging for reverse-proxy;
- ip - fixed hanging connections for reverse-proxy;
- ip-settings - added ipv4-fragment-time and ipv4-high-fragment-thresh settings, use default values based on total device memory;
- ipip - disabled IPv6 link-local address generation;
- ippool - fixed issue when changing pool with already used addresses;
- ippool6 - allow variable length pool;
- ippool6 - properly follow pool changes for already used prefixes;
- ipsec - added netlink-based SA and policy handling;
- ipsec - fixed SA proto parameter conversion and policy "none" type handling;
- ipv6 - added from-pool-policy address property that controls how address is acquired from the pool;
- ipv6 - added without-acquire address property;
- ipv6 - always ensure that prefix length matches the one given by the pool even if address was set to 0;
- ipv6,ra - added option to ignore MTU and DNS servers;
- ipv6,ra - added router-advertisement-route-distance setting;
- ipv6,ra - allow receiving DNS servers over multiple interfaces;
- ipv6,ra - clamp valid-lifetime to minimum of 2h on deprecation;
- ipv6,ra - extend processed RA logging;
- ipv6,ra - fixed advertised DNS parameter logging;
- ipv6,ra - fixed changing default "all" interface configuration;
- ipv6,ra - fixed DNS and pref64 property unset;
- ipv6,ra - fixed sending only DNS or MTU when prefix is set to "none";
- ipv6,ra - improved service stability;
- ipv6,ra - use received prefix when RA on-link flag is 0 (introduced in v7.22);
- ipv6,ra - warn when interface is under the bridge;
- l3hw - added HW offloaded VRF support on CRS8xx switches;
- l3hw - added VRF assignment via switch ACL rules on CRS8xx switches (CLI only);
- l3hw - fixed VXLAN packet matching by local IP;
- leds - added new PoE fault LED cases (bad fw, PoE card power cable disconnected, PoE card not inserted);
- log - added CC option for e-mail action;
- log - added ssld error logging;
- log - added TLS support;
- lte - added fast SIM switchover support using AT channel for MBIM modems without MBIM_CID_MS_UICC_RESET firmware support;
- lte - configure IP address for AT modems even if no DNS is received from the network;
- lte - do not duplicate primary-band also in ca-band for QMI modems in 5G SA network;
- lte - do not reconfigure modem in passthrough mode if passthrough cannot be activated because of slave interface;
- lte - emit RS every 60s on LTE interface;
- lte - filter packets by MAC in multi-apn setup for EC200A-EU modem;
- lte - fixed automatic modeswitch for "Chateau 5G R16" and "Chateau 5G";
- lte - fixed broken network scan after being interrupted by reconfiguration;
- lte - fixed missing automatic redial when cellular connectivity is lost for R11e-LTE;
- lte - fixed RSSI signal monitor 3rd party modems where AT+CSQ responses are not parsed;
- lte - fixed user set MTU not applied to LTE interface;
- lte - improved system stability for devices with QMI modems;
- lte - improved system stability when modem configured in passthrough mode with VLANs for "Chateau 5G R16" and "Chateau 5G";
- lte - improved system stability;
- lte - improvements for passthrough mode in IPv6 only setup;
- lte - keep MAC persistent across reboots for QMI modems;
- lte - read subscriber number also for QMI modems;
- lte - removed LTE external-antenna scan;
- lte - set SMS send timeout to 180s;
- lte - show external-antenna as "none" before actual scan is done instead of empty value;
- lte - show MTU as "auto" also on interface level if "auto" used;
- lte - SIMCom modems, skip error state when modem sends improperly formatted CREG response/URC;
- lte - stop network scan on interruption for QMI modems;
- lte - unify "modem-init" for all driver types;
- macsec - added aes-gcm-xpn-128 cipher support;
- ospf - change virtual link configuration to use OSPF interface directly;
- ospf - fixed missing interface-template configuration which previously was converted by upgrading from RouterOS v6;
- ospf - fixed nssa bit check;
- ospf - fixed routes not being installed on ABRs;
- ovpn - fixed OVPN push routes;
- pimsm - do not ignore priority when selecting RP from BSR;
- pimsm - fixed possible BSR loop;
- pimsm - improved stability;
- ping - resolve domain name to IPv6 if src-address is IPv6 address;
- ping - show time in microseconds for flood-ping;
- poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
- port - added support for "tcp-client" and "udp" modes for "remote-access";
- port - expose RG650E-EU diagnostics channel;
- port - remove unused serial port on RB1100AHx4;
- pppoe - do not reset pppoe-client interface when adding a comment;
- ptp - added support for CRS812, CRS804;
- ptp - allow manual domain configuration for 802.1AS profile;
- ptp - fixed crash during initialization on some devices;
- ptp - set DSCP (EF) for default profile when using IPv4;
- qos-hw - added automap setting to QoS Profiles (enabled by default);
- qos-hw - added ECN and PFC support on CRS8xx;
- qos-hw - added new default "auto" value to mirror-buffers, multicast-buffers, shared-buffers QoS Settings (old defaults are shown in export after upgrade);
- qos-hw - added queueX-byte-max stats to port usage on CRS8xx;
- qos-hw - fixed CPU traffic mapping to queues on CRS8xx switches;
- qos-hw - introduced lossless-traffic-class and lossless-buffers settings;
- qos-hw - removed shared-pool-index setting;
- route - fixed link-local interface check when resolving IPv6 nexthops;
- route - improved service stability when removing routes;
- routerboard - fixed applying settings via WinBox on devices with fixed CPU frequency;
- routerboot - fixed Netinstall failure when using multiple partitions on AL73400, AL52400, AL32400 CPUs ("/system routerboard upgrade" required);
- sftp - fixed path canonicalization request;
- smb - do not start /ip smb server on container interfaces;
- sniffer - added IP ECN field;
- sniffer - fixed missing VLAN tag in the TZSP packets;
- snmp - added missing BRIDGE-MIB OIDs (dot1dBaseNumPorts, dot1dBaseType, dot1dStpDesignatedRoot, dot1dStpRootCost, dot1dStpRootPort, dot1dStpHoldTime, dot1dStpBridgeMaxAge, dot1dStpBridgeHelloTime, dot1dStpBridgeForwardDelay, dot1dStpPortForwardTransitions, dot1dTpAgingTime);
- snmp - added missing LLDP-MIB OIDs (lldpMessageTxInterval, lldpMessageTxHoldMultiplier, lldpLocManAddrTable);
- snmp - enforce minimum password length;
- snmp - fixed compliance of LLDP-MIB lldpRemManAddrTable;
- snmp - fixed connection tracking counter OID;
- snmp - fixed dot1dStpPortDesignatedPort OID;
- snmp - fixed dot1dStpPortDesignatedRoot and added dot1dStpPortDesignatedBridge OID;
- snmp - fixed ifSpeed and ifHighSpeed OIDs for 802.3ad and balance-xor bonding interfaces;
- snmp - fixed lldpLocSysDesc OID;
- snmp - implemented LTE firmware upgrade option;
- snmp - use "/ip/neighbor/lldp" for lldpRemTable and lldpRemManAddrTable (fixes lldpRemTable showing neighbors discovered by MNCP or CDP);
- ssh - do not advertise password login method when it is disabled;
- ssh - improved host resolve error logging;
- switch - rework how IEEE reserved MAC addresses are handled on QCA8337, Atheros8327;
- switch - updated switch-marvell.npk driver;
- switch - use names instead of numbers in switch menu configuration export;
- system - added FCC Part 15 Compliance label to "System/Regulatory" menu;
- system - improved stability for internal RouterOS service communication;
- system - included full certificate chain to Windows executables;
- system - keep HTTP/2 connection open if it is not closed by system or server;
- system - make default identity based on board name;
- upgrade - added the option to configure HTTP/HTTPS modes when connecting to MikroTik upgrade servers;
- upgrade - changed status message for scheduled installs;
- upgrade - check for available packages when opening System/Packages in GUI;
- upgrade - use HTTPS by default when connecting to MikroTik upgrade servers;
- usb - added ax88179_178a driver;
- usb - improved USB Ethernet adapter recognition;
- usb - show USB device reported maximum power;
- veth - fixed link-local address not being configurable as a gateway;
- vxlan - improved system stability for TILE devices;
- webfig - added postfix byte value support (e.g. "/ip/settings/ipv4-high-fragment-thresh");
- webfig - added support for filter in tables;
- wifi - improved authentication stability for WiFi 7 access points;
- wifi-mediatek - fixed HE capabilities IE on 2GHz band;
- wifi-mediatek - fixed multicast-enhance functionality;
- wifi-qcom-be - fixed forwarding of 4-address data from station to station;
- wifi-qcom-be - fixed incorrect channel info for punctured channels;
- wifi-qcom-be,mediatek - correctly advertise RRM capabilities when 802.11k neighbor reports are enabled;
- winbox - added "MLD Static" and "MLD Datapath" properties under the "WiFi/CAP" menu;
- winbox - added "Multipath" property under the "Routing/BGP/Instance" menu;
- winbox - added “Remove” action under "System/Certificates/Requests" menu;
- winbox - added comment for DHCPv6 relay;
- winbox - added group numbers for DH and PFS groups for IPsec;
- winbox - allow setting "CAPsMAN address" for CAP as domain name;
- winbox - do not accept interface without specifying IP or MAC in "Ping To" field;
- winbox - improved "External Antenna" property display;
- winbox - improved Routing/PIM SM menu;
- winbox - move bridge IGMP Snooping checkbox to IGMP tab;
- winbox - rename DHCPv6 server binding "Peer Address" to "Client Address";
- winbox - show "Directory URL" field for ACME certificates in Certificate view;
- winbox - show "IPv6 Address" property by default under the "IP/Neighbors" menu;
- winbox - show accepted connections in tree view under "IP/Services" menu;
- winbox - updated socksify icon for firewall NAT rules;
- wireguard - improved system stability;
- www - added partial content (HTTP 206) support;
- www - improved system stability;
To upgrade, click Check For Updates under System/Packages menu and select the testing Channel in RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download
- Everything went smoothly
- I encountered an issue after the update (please post about the device, configuration, and unexpected symptoms)
- I encountered an issue, but solved it (please post the solution)
0
voters
If you experience version related issues, then please send supout file from your router to support@mikrotik.com. The file must be generated while a router is not working as suspected or after some problem has appeared on the device
Please keep this forum topic strictly related to this particular RouterOS release.
