CVE-2026-39042
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability in MikroTik RouterOS versions 7.21.x before 7.21.4 and 7.22.x before 7.22.2 exists in the unflatten() function of the libumsg.so library. A remote attacker can exploit this flaw to cause a denial of service (DoS).
Risk Assessment
An attacker can remotely render a MikroTik router or switch unavailable, disrupting network operations and potentially requiring a manual device reboot.
Recommendation
Immediately upgrade RouterOS to version 7.21.4 or later (for the 7.21.x branch) or to version 7.22.2 or later (for the 7.22.x branch).
Other vulnerabilities in MikroTik RouterOS
See all- CVE-2024-27686High
Mikrotik RouterOS versions 6.40.5 through 6.49.10 (fixed in 7) allow a remote attacker to cause a device crash via crafted packet data to the SMB service on TCP port 445.
- CVE-2026-14227Medium
A product with the MikroTik RouterOS API enabled is vulnerable to insufficient session expiration. Active sessions may retain their previous permission set after inactivity timeouts or user-group changes.
- CVE-2026-16347High
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts.
- CVE-2023-47310Medium
A misconfiguration in the default settings of MikroTik RouterOS 7 allows incoming IPv6 UDP traceroute packets. The issue is fixed in version v7.14.
- CVE-2023-24094High
A vulnerability in the bridge2 component of MikroTik RouterOS version 6.40.5 allows attackers to cause a Denial of Service (DoS) by sending crafted packets.
Original NVD description (English source)
An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten() function in libumsg.so.