Is MikroTik RouterOS 6.49.13 affected?

Vulnerabilities affecting 6.49.13

• 9.8
  CVE-2026-86060 RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to… KEV · fixed in 6.49.21
• 8.8
  CVE-2022-45313 Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message. fixed in 7.5
• 8.2
  CVE-2026-67277 RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra… KEV · fixed in 6.49.21
• 7.2
  CVE-2025-6443 Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Aut… fixed in 7.20
• 6.5
  CVE-2026-67279 RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send… KEV · fixed in 6.49.21
• 6.4
  CVE-2022-45315 Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows authenticated attackers to execute arbitrary code via a crafted p… fixed in 7.6
• 5.4
  CVE-2024-54772 An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18.… fixed in 6.49.18

Newer releases