!) fixed a service security issue, home user with default config not affected, but we recommend the upgrade for all users regardless;

asplain                 | comment
         0              | reserved RFC7607
         1 –      23455 | global
     23456              | reserved AS_TRANS
     23457 –      64495 | global
     64496 –      64511 | Reserved RFC5398
     64512 –      65534 | Reserved for Private Use RFC6996
     65535              | Reserved RFC7300
     65536 –      65551 | Reserved for use in documentation and sample code RFC5398
     65552 –     131071 | Reserved    
    131072 – 4199999999 | global    
4200000000 – 4294967294 | Reserved for Private Use RFC6996
             4294967295 | Reserved RFC7300

asdot                     | comment
          0               | Reserved RFC7607
          1 –       23455 | global
      23456               | Reserved AS_TRANS
      23457 –       64495 | global
      64496 –       64511 | Reserved RFC5398
      64512 –       65534 | Reserved for Private Use RFC6996
      65535               | Reserved RFC7300
    1.0     –     1.15    | Reserved for use in documentation and sample code RFC5398
    1.16    –     1.65535 | Reserved    
    2.0     – 64086.59903 | global    
64086.59904 – 65535.65534 | Reserved for Private Use RFC6996
              65535.65535 | Reserved RFC7300

This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information.

*) btest - improve stability;
*) console - improve stability;
*) fetch - improve stability of the TFTP client;
*) snmp - improve stability of SNMP;
*) snmp - properly validate password length when applying configuration;
*) ssh - refactor SSH internal processes and improved system stability;
*) system - improve stability;
*) system - updated certificate for Windows executable signing;
*) dhcp - improve stability of DHCP handling;
*) disk - improve stability of the SMB server;
*) ipsec - improve IKE handshake stability;
*) tunnel - fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22);
*) webfig - improve stability;
*) www - improve stability;

*) bgp - show interface names and VRF names in BGP logs;
*) bgp - add the always-compare-med setting;
*) bgp - fix BGP unnumbered connections within a VRF;
*) evpn - publish MAC-IP routes (RT-2) for neighbors;

*) dhcpv4-server - add ipv6-only-preferred parameter to respect option 108;
*) ipv6 - fix a failure when releasing DHCPv6 prefix delegation pools;
*) ipv6 - fix cases when address is lost after reboot if prefix was taken from pool;
*) ipv6 - fix the DNS timer in router advertisements;
*) ipv6 - ignore router advertisements received on interfaces not in the accepting list;

*) snmp - add an OID and logging for blacklisted program access;
*) snmp - add CAPsMAN radio data to SNMP;
*) snmp - add dynamic SNMP engine ID assignment;
*) snmp - add interface table with mtu and l2mtu OIDs;
*) snmp - add IP pool OIDs;
*) snmp - add IPv6 address and interface name to the MNDP neighbour table;
*) snmp - add OID blacklisting;
*) snmp - add OIDs for Netwatch probes;
*) snmp - add OSPF MIB tables;
*) snmp - add SHA-2 authentication for SNMPv3;
*) snmp - add transmit drop counters;
*) snmp - add VRRP status OIDs for monitoring;
*) snmp - fix the reported capability flags in LLDP-MIB;
*) snmp - fix the snmp tools timing out when authentication is used;
*) snmp - log a warning when the src-address family does not match the request;
*) snmp - remove an interface OID that should not be accessible;
*) system - remove the channel label from the RouterOS version;

*) poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) ethernet - fix link flap and unexpected reboots on RB5009;
*) ethernet - fix SFP compatibility on hAP ax S and hEX S (2025) devices;

*) ssh - add a connection id to SSH log entries;
*) ssh - add host key verification for the SSH client;
*) ssh - limit server output to the client's window size;
*) ssh - show router host key fingerprint;
*) ssh - switch the default host key type to Ed25519;
*) ssh - warn users when weak RSA key is being used;
*) system - improve stability (includes CVE-2026-31431, CVE-2026-67280);

*) certificate - fix ACME certificate issuance for wildcard domains;
*) certificate - refactor certificate internal processes;

*) winbox - show WireGuard peer information;
*) wireguard - add the client-mtu parameter;
*) wireguard - allow referencing a peer by its name;
*) wireguard - allow unsetting the client-listen-port;
*) wireguard - improve error message reporting when adding a new peer;
*) wireguard - keep peer rx/tx counters when the peer is disabled and enabled;
*) wireguard - support comment lines in wg-import configuration files;
*) wireguard - treat empty private-key and preshared-key values as none;
*) wireguard - use the MTU value when importing a configuration;
*) wireguard - warn when an allowed-address overlaps another peer;

*) tftp - add VRF support;

*) bridge - add dynamic ARP inspection;
*) bridge - add IP source guard;
*) bridge - warn about VLAN entries when vlan-filtering is disabled;

*) firewall - add NAT-related fields to CEF format logging;

*) cmr - add initial implementation of centralised platform for RouterOS devices, allowing updates, monitoring, alerts and other options;
*) l3hw - add VRRP hardware offloading support;

*) dhcpv6-server - add a dns-none option to not include DNS options in responses;
*) dhcpv6-server - fix a DHCPv6 server failure when the RADIUS reply contains an empty delegated IPv6 prefix;
*) lte - fix IPv6 route not being added on modems that do not report a gateway via control interface;
*) switch - fix switch rules port matchers not working on IPv6 traffic on Atheros-based switch chips;

*) ethernet - move the port bandwidth setting to the switch port menu;

*) interface - show if interface is blocked by stp or dot1x;

*) switch - add interface-list support to port isolation;

What's new in 6.49.23 (2026-10-07):

*) system - improve stability (includes CVE-2026-84411);

What's new in 7.23.8 (2026-10-08):

*) console - fix console output of /system/identity/print being split into multiple lines (introduced in v7.23.6);
*) ethernet - improved stability when forcing unsupported link speed;
*) ipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder;
*) ospf - fix unset interface template parameters not being applied to interfaces;
*) quickset - fix the WAN interface being selected incorrectly;
*) system - improve stability (includes CVE-2026-84411);
*) system - stop the flash configuration store from growing on dynamic configuration changes;
*) wifi - fix malformed management frame information elements advertising availability of multiple 6GHz APs;
*) wifi - update radio regulatory information;