What's new in 7.22.1 (2026-Mar-23 16:35):

*) bgp-vpn - fixed non-working import filter after reboot;
*) certificate - added option to configure built-in trust store for all services (CLI only);
*) certificate - use "default" for built-in trust store default value;
*) chr - improved virtio_net stability;
*) console - removed the "reset" command from shared settings menus (IP/IPv6/Bridge/L3HW/Neighbor-Discovery/Connection-Tracking);
*) defconf - fixed architecture detection for apps;
*) hardware - name serial devices after port names;
*) hardware - name storage hardware devices after slot name in "/disk" menu;
*) l3hw - fixed a system stability issue (introduced in v7.21);
*) leds - allow multiple interface selection for interface-activity trigger;
*) log - do not provide non-existent logging topics for configuration;
*) log - fixed "/system/logging/action/get" command (introduced in v7.22);
*) lte - fixed LTE modem automatic modeswitch (introduced in v7.22);
*) lte - fixed Tx stat reporting in LTE passthrough mode (introduced in v7.22);
*) qos-hw - display queue0 limits for CPU port;
*) qos-hw - fixed "offline" tx-manager ability to queue at least one packet (introduced in v7.21);
*) qos-hw - prohibit setting CPU port with "offline" tx-manager;
*) quickset - fixed configuration of multi-link APs;
*) ssh - make login process asynchronous;
*) switch - disable EEE on RB5009 and CCR2004-16G-2S+ devices;
*) system - fixed total memory reporting on hAP be3 Media;
*) tr069 - fixed modem extended revision reporting;
*) wifi - fixed bridge VLAN configuration for multi-link interfaces;
*) wifi - fixed EAP authentication for multi-link clients;
*) wifi - improved link-specific parameter application after reboot for multi-link interfaces;
*) wifi - improved stability during association;
*) winbox - added "Supported HW Caps" and "Multi Link Mode" configuration options under the "WiFi/Provisioning" menu;
*) winbox - do not set empty chain when adding/editing routing rule;
*) winbox - fixed "Remote AS" setting under the "Routing/BGP/Connections" menu;
*) winbox - fixed "Src/Dst Address Type" under the "IP/Firewall/NAT" menu;
*) winbox - make the band field on the WiFi registration table multi-argument;

What's new in 7.21.4 (2026-Apr-21 09:49):

*) bgp - fixed stability issue when non-existent output select-chain was specified;
*) bgp-vpn - allow modifying scopes with routing filters;
*) bgp-vpn - fixed non-working import filter after reboot;
*) bgp-vpn - use target scope for imported route;
*) bridge - fixed missing dynamic "switch-cpu" VLAN entry in WiFi setup;
*) bridge - fixed performance regression in complex setups with vlan-filtering (introduced in v7.20);
*) console - removed the "reset" command from shared settings menus (IP/IPv6/Bridge/L3HW/Neighbor-Discovery/Connection-Tracking);
*) container - fixed issue where the container might not start after upgrading if root-dir was not set;
*) container - improved error message if a container fails to start;
*) defconf - fixed L009 configuration (introduced in v7.21);
*) ethernet - fixed false excessive broadcast warning (introduced in v7.20);
*) firewall - improved system stability;
*) ipsec - improved aes256-ctr stability on L009;
*) ipsec - removed modp8192 proposal on MIPS architectures;
*) ipv6,ra - use received prefix when RA on-link flag is 0;
*) isis - improved stability with fragmented CSNP;
*) l2tp - improved system stability on TILE architecture;
*) l3hw - fixed missing VLAN counters after reboot (introduced in v7.21);
*) l3hw - fixed stability issue (introduced in v7.21);
*) leds - fixed default LED configuration for CCR2004-1G-12S+2XS;
*) log - do not provide non-existent logging topics for configuration;
*) lte - fixed framed route support for the first APN;
*) lte - fixed missing automatic redial when cellular connectivity is lost for R11e-LTE;
*) lte - fixed user set MTU not applied to LTE interface;
*) lte - override the "auto" or 0 MTU in "interface" menu to 1500;
*) ospf - fixed typos in log messages;
*) ospf - improved stability on configuration change;
*) ovpn - fixed OVPN push routes;
*) poe-out - firmware update for CRS354-48P-4S+2Q+ (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out - fixed rare PoE-Out firmware upgrade failure on CRS354-48P-4S+2Q+;
*) ptp - allow manual domain configuration for 802.1AS profile;
*) ptp - set DSCP (EF) for the default profile when using IPv4;
*) qos-hw - display queue0 limits for CPU port;
*) qos-hw - fixed "offline" tx-manager ability to queue at least one packet (introduced in v7.21);
*) qos-hw - prohibit setting CPU port with "offline" tx-manager;
*) route - added SLAAC route redistribution for IPv6 capable routing protocols;
*) route - do not set blackhole flag for synthetic routes;
*) route - improved service stability when removing routes;
*) routerboard - fixed applying settings via WinBox on devices with fixed CPU frequency;
*) routing-filter - added possibility to match SLAAC and bgp-mpls-vpn route types;
*) ssh - make login process asynchronous;
*) switch - fixed stability issue when changing bridge multicast-router property on CRS1xx/2xx (introduced in v7.19);
*) system - added FCC Part 15 Compliance label to "System/Regulatory" menu;
*) system - improved stability for internal RouterOS service communication;
*) system - improved system stability;
*) system - improved upgrade service stability when the server is unreachable;
*) system - included full certificate chain to Windows executables;
*) user - properly apply login delay (introduced in v7.20);
*) wifi-mediatek - fixed communication issues on 802.11ax access points with Intel clients;
*) wifi-mediatek - fixed HE capabilities IE on 2GHz band;
*) winbox - fixed "Remote AS" setting under the "Routing/BGP/Connections" menu;
*) winbox - fixed "Src/Dst Address Type" under the "IP/Firewall/NAT" menu;
*) winbox - fixed L3HW default value for VLAN interface (introduced in v7.21);
*) winbox - properly display multiple bands for multi-link interface clients under registration table;
*) winbox - rearrange filter wizard parameters in tabs;
*) www - improved service stability when cancelling REST API sessions;

What's new in 7.22.2 (2026-Apr-22 11:03):

*) app - fixed uptime-kuma and jupyter-notebook;
*) bgp - fixed stability issue when non-existent output select-chain was specified;
*) bridge - fixed missing dynamic "switch-cpu" VLAN entry in WiFi setup;
*) bridge - synchronize only local bridge MAC addresses for MLAG (introduced in v7.22);
*) console - rename "cpu-used-per-cpu" to "cpe-used-per-core" in "/system/resource/monitor";
*) container - fixed losing container after reboot;
*) ethernet - fixed false excessive broadcast warning (introduced in v7.20);
*) firewall - improved system stability;
*) ipsec - fixed expired SA handling to prevent “no such item” errors during listing;
*) ipv6,ra - use received prefix when RA on-link flag is 0 (introduced in v7.22);
*) isis - improved stability with fragmented CSNP;
*) leds - fixed default LED configuration for CCR2004-1G-12S+2XS;
*) leds - fixed LED dark mode for RB5009;
*) lte - fixed missing automatic redial when cellular connectivity is lost for R11e-LTE;
*) ospf - improved stability on configuration change;
*) ovpn - fixed OVPN push routes;
*) poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out - fixed occasional detection issue when using auto-on mode;
*) ptp - allow manual domain configuration for 802.1AS profile;
*) ptp - set DSCP (EF) for the default profile when using IPv4;
*) route - improved service stability when removing routes;
*) routerboard - fixed applying settings via WinBox on devices with fixed CPU frequency;
*) system - added FCC Part 15 Compliance label to "System/Regulatory" menu;
*) system - improved stability for internal RouterOS service communication;
*) system - improved system stability;
*) system - included full certificate chain to Windows executables;
*) usb - fixed crash when using Ethernet adapter (introduced in v7.22);
*) vrrp - fixed packet drop in CHR (introduced in v7.22);
*) wifi - improved authentication stability for WiFi 7 access points;
*) wifi-mediatek - fixed communication issues on 802.11ax access points with Intel clients;
*) wifi-mediatek - fixed HE capabilities IE on 2GHz band;
*) wifi-qcom-be - fixed forwarding of 4-address data from station to station;
*) winbox - added option to configure built-in trust store for all services;
*) www - improved service stability when cancelling REST API sessions;

RouterOS 7.22.3 [stable]
What's new in 7.22.3 (2026-May-07 12:19):

*) console - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal;
*) ethernet - fixed stability issue after switch reset on devices with IPQ-40xx, IPQ-60xx CPUs (introduced in v7.22);
*) vrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge for Marvell Prestera switch chip;

✅ Безопасность по умолчанию – обновления теперь тянутся через HTTPS, а не HTTP. Можно отдельно настроить режимы подключения к серверам MikroTik.
📦 App/Container – прорыв!
Добавлено 18 новых приложений (birdnet-go, cryptpad, metube, mikrodash, odoo, paperless-ngx, zulip, docker-сборки с Portainer/Komodo/Dockge и др.)
Теперь поддерживаются XFS-диски, проверка доступности портов, автоматический проброс устройств (например, otbr)
Контейнеры: restart-policy, ограничение памяти, графики в статистике, поддержка USB-аудио, графики stats
Ollama + OpenWebUI уже в комплекте – локальный AI на роутере!
Больше не нужно мучиться с YAML – улучшена работа с параметрами, стоп-сигналами, переменными окружения.
🌉 Bridge – умный L2
DHCPv6 snooping с кастомными Option 18/37
Кастомный Option 82 (circuit-id/remote-id) вместо старого add-dhcp-option82 – конфиг обновится автоматом
Улучшена синхронизация MAC для MLAG.
🔐 IPsec – новая netlink-обработка SA/policy, исправлена работа expired SA, улучшена валидация HMAC.
🧠 L3HW на CRS8xx – теперь VRF оффлоудится в железо + VRF через ACL-правила (CLI only).
📡 LTE – куча исправлений: фикс network scan, persistent MAC для QMI, быстрый перебор SIM, улучшен passthrough в IPv6-only.
📊 SNMP – добавлены недостающие OID из BRIDGE-MIB и LLDP-MIB, исправлена совместимость, реализована опция апгрейда прошивки LTE через SNMP.
🛠 Консоль и GUI
export получил параметр path
Синтаксис-хайлайт для скриптов в dhcp-client/server, ppp/profile
WinBox: группа DH/PFS в IPsec, доменное имя для CAPsMAN, фильтры в таблицах
Webfig: поддержка постфиксов (K/M/G) и фильтров в таблицах.
⚡️ QoS-HW на CRS8xx – ECN, PFC, lossless-классы, автоматическое отображение очередей.
🌍 DNS – DoH с поддержкой HTTP/2 на ARM64 и x86/CHR.
📜 Логи – новая тема discover для событий DNS, TLS для логов, CC в email-действиях.
⚠️ На что обратить внимание при обновлении
Bridge – настройка add-dhcp-option82 автоматически конвертируется в новые поля dhcp-agent-circuit-id/remote-id. Проверьте, если использовали кастомные скрипты.
Cloud backup теперь требует отдельного policy policy.
PoE-out на 802.3at-платах – прошивка обновится, будет кратковременное отключение питания.
Container routing rules вернулись к приоритетам до v7.22 (реверс).
/system/routerboard upgrade требуется для Netinstall на CPU AL73400/52400/32400
🐛 Основные исправления
Стабильность для RB3011, L009, NetMetal ax, hAP ax lite, Alpine CPU
Исправлен WireGuard config netmask в BTH
Фикс mac-table на RB2011 (v7.21 regression)
Пропажа счётчиков ethernet на неактивных портах CRS8xx (v7.22)
Утечка памяти в netwatch с HTTP-пробой
Сломанный VXLAN fast-path при checksum=no (v7.20 regression)
И ещё ~150 исправлений по всему стеку.
🧩 Важные мелочи
TimeZone – обновлён до tzdata2026b.
USB – добавлен ax88179_178a, лучше распознавание адаптеров.
Zerotier – обновлён до 1.14.2.
Switch – человеко-читаемые имена в экспорте.
Disk – появились smart-info, проверка/восстановление ext4/Btrfs/XFS.

What's new in 7.23.1 (2026-Jun-02 12:25):

*) app - fixed bogus configuration export;
*) app - fixed making empty directories when running configuration export;
*) bgp - fixed memory leak;
*) bridge - fixed stability issue when using DHCPv4 snooping;
*) disk - avoid reading SCSI stats all the time to allow disks to go to sleep;
*) disk - improved error message when a swap file is created without "file-size" specified;
*) ethernet - fixed stability issue with TSO on Alpine CPUs;
*) firewall - improved system stability;
*) ipsec,ike2 - improved TSi validation to prevent modecfg address conflicts;
*) ipv6 - do not disable IPv6 FastPath when Traffic Flow is enabled;
*) ospf - added missing interface parameters;
*) ospf - fixed unresolved route problem when "routing-table" setting is used;
*) ptp - rename "smpte" to "smpte-2059";
*) route - improved overall stability;
*) route - removed deprecated "/routing/route/rule" menu;
*) switch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs;

!) fixed a service security issue, home user with default config not affected, but we recommend the upgrade for all users regardless;

Ченджлог .1:
What's new in 7.24.1 (2026-Aug-21 16:06):

*) app - fix entrypoint and cmd for opencloud-extended-collabora app;
*) bridge - fix missing host "E" flag for CRS8xx series switches;
*) bridge - fix MLAG for CRS8xx series switches;
*) bridge - fix stability issue when using VRRP on bridge;
*) bridge - improve MLAG host aging and deletion logic;
*) console - fix "find" command argument lookup issue (introduced in v7.24);
*) container - improve host isolation when container is set to "privileged=yes";
*) l3hw - fix stability issue on IPv6 offload enable;
*) l3hw - fix VRF offload on bond interface remove;
*) leds - fix "interface-status" trigger;
*) snmp - properly validate password length when applying configuration;
*) ssh - refactor SSH service internal processes;
*) switch - fix possible Rx traffic stall on CPU for devices with Marvell Prestera switch chip;
*) switch - fix stability issue during L2 loop for 98DX224S, 98DX226S, 98DX2528, and 98DX3236 switch chips;
*) switch - fix stability issue on RB3011 (introduced in v7.22);
*) system - improve handling of invalid SSL/TLS requests;
*) wifi - fix stability issue for hAP be lite;
*) wireguard - fix peer disable/enable state handling, which could leave the tunnel non-functional (introduced in v7.24);
*) wireguard - fix private key handling, including empty private keys;
*) www - improve service responsiveness when receiving malformed packets;

Ченджлог .2 (security update):
What's new in 7.24.2 (2026-09-03):

This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information.

*) bgp - fix BGP link-local nexthops unreachable over a VRF and a crash when disabling an unnumbered connection;
*) btest - improve stability;
*) certificate - fix changing the built-in trust store setting (introduced in 7.22.2);
*) console - improve stability;
*) console - fix a memory leak in background scripts;
*) console - improve stability;
*) container - improve container image extraction;
*) dhcp - improve stability of DHCP handling;
*) disk - improve stability of the SMB server;
*) ethernet - improve stability on hAP be3 Media;
*) fetch - improve stability of the TFTP client;
*) ipv6 - add a neighbor discovery ping;
*) leds - fix LEDs set to interface status staying off when the interface is active;
*) lte - fix the RG650E-EU modem not bringing link up after a firmware update;
*) ping - add parameter checks for arp ping;
*) poe-out - fixed missing PoE-Out interface on hEX PoE lite, RB260GSP, OmniTIK 5 PoE, PowerBox;
*) ssh - refactor SSH internal processes and improved system stability;
*) system - improve stability;
*) webfig - improve stability;
*) winbox - fix the "addresses" spelling in read-only fields;
*) www - improve stability;

What's new in 7.23.4 (2026-09-03):

This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information.

*) bgp - fix BGP link-local nexthops unreachable over a VRF and a crash when disabling an unnumbered connection;
*) btest - improve stability;
*) certificate - fix changing the built-in trust store setting (introduced in 7.22.2);
*) console - improve stability;
*) dhcp - improve stability of DHCP handling;
*) disk - improve stability of the SMB server;
*) fetch - improve stability of the TFTP client;
*) ipsec - fixed expired SA handling to prevent "no such item" errors during listing;
*) ipsec - improve IKE handshake stability;
*) leds - improved interface stats activity for devices with Marvell Prestera switch chip;
*) lte - removed extra restart after firmware upgrade for EC200A-EU modem;
*) lte - fix the RG650E-EU modem not bringing link up after a firmware update;
*) ping - add parameter checks for arp ping;
*) snmp - properly validate password length when applying configuration;
*) ssh - refactor SSH internal processes and improved system stability;
*) system - improve handling of invalid SSL/TLS requests;
*) system - improve stability;
*) tunnel - fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22);
*) webfig - improve stability;
*) wifi - updated radio regulatory information;
*) winbox - fix the "addresses" spelling in read-only fields;
*) wireguard - fixed peer Tx/Rx counters;
*) wireguard - generate port number when specified as zero;
*) wireguard - reinitialize socket on VRF change;
*) www - improve stability;

What's new in 7.24.4 (2026-09-16):

*) lte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.24.3);

If you have already upgraded to 7.23.6 or 7.24.3, follow these steps to restore LTE functionality on affected devices:

1. Upgrade RouterOS to version 7.23.7 or 7.24.4

2. Update the modem firmware:
/interface/lte/firmware-upgrade [find] upgrade=yes

3. Reboot the router.

For more details, see:
https://forum.mikrotik.com/t/warning-lte-interface-stops-working-after-upgrade-to-7-23-6-7-24-3

What's new in 7.24.5 (2026-09-29):

*) bridge - disable DHCP snooping ip binding table (introduced in v7.24);
*) bridge - enable vlan hardware offloading on hAP be3 Media device;
*) console - fix console output of /system/identity/print being split into multiple lines (introduced in v7.24.3);
*) console - fix scheduler scripts with the default start date and time not being triggered (introduced in v7.24);
*) ethernet - improve stability on hAP be3 Media device;
*) lte - improve stability for MBIM modem mode switch;
*) ospf - fix unset interface template parameters not being applied to interfaces;
*) poe-out - fix loss of PoE-out capability on CRS328-24P-4S+ after a reboot;
*) system - improve stability;
*) wifi - update radio regulatory information;

What's new in 7.23.8 (2026-10-08):

*) console - fix console output of /system/identity/print being split into multiple lines (introduced in v7.23.6);
*) ethernet - improved stability when forcing unsupported link speed;
*) ipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder;
*) ospf - fix unset interface template parameters not being applied to interfaces;
*) quickset - fix the WAN interface being selected incorrectly;
*) system - improve stability (includes CVE-2026-84411);
*) system - stop the flash configuration store from growing on dynamic configuration changes;
*) wifi - fix malformed management frame information elements advertising availability of multiple 6GHz APs;
*) wifi - update radio regulatory information;