CVE-2026-112158: RouterOS 6.0, 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7, 6.8, 6.9, 6.10, 6.11, 6.12, 6.13, 6.14, 6.15, 6.16, 6.17, 6.18, 6.19…

Affected technology

RouterOS · 6.0, 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7, 6.8, 6.9, 6.10, 6.11, 6.12, 6.13, 6.14, 6.15, 6.16, 6.17, 6.18, 6.19, 6.20, 6.21, 6.22, 6.23, 6.24, 6.25, 6.26, 6.27, 6.28, 6.29, 6.30, 6.31, 6.32, 6.33, 6.34, 6.35, 6.36, 6.37, 6.38, 6.39, 6.40, 6.40.0, 6.40.1, 6.40.2, 6.40.3, 6.40.4, 6.40.5, 6.41, 6.42, 6.43, 6.44, 7.20.0, 7.20.1, 7.20.2, 7.20.3, 7.20.4, 7.20.5, 7.20.6, 7.20.7, 7.20.8
MikroTik

Description’s affected range: up to 6.40.5/6.44/7.20.8

Component: Not specified by the source
Function: same_check
File: ipt_SAME.ko

Attack conditions (VulDB, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

VulDB’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.