What is the CVSS score of CVE-2026-39042?

CVE-2026-39042 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of MikroTik RouterOS are affected by CVE-2026-39042?

MikroTik RouterOS versions 7.21 through 7.22 contain a high-severity denial-of-service vulnerability enabling unauthenticated remote attackers to crash network devices, directly impacting…

How to fix or mitigate CVE-2026-39042?

Within 24 hours, identify and inventory all MikroTik RouterOS devices running versions 7.21.x (prior to 7.21.4) or 7.22.x (prior to 7.22.2) in your network infrastructure, and segment them from untrusted networks if operationally feasible. Within 7 days, implement network access controls to restrict remote access to these devices via firewall rules, and contact MikroTik support to request an estimated patch availability date and interim mitigation guidance. Within 30 days, develop and test upgrade paths to non-affected RouterOS versions (7.20.x or newer patched builds when released), establish monitoring for abnormal device restarts as an early indicator of exploitation attempts, and ensure redundant devices are staged for rapid failover during upgrades.

MikroTik RouterOS CVE-2026-39042

EUVD-2026-43601 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-07-13 mitre

GHSA-p5h9-77xr-72r8

Denial Of Service Integer Overflow Mikrotik N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remotely reachable IPC message with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:19 vuln.today

CVSS changed

Jul 14, 2026 - 17:22 NVD

7.5 (HIGH)

CVE Published

Jul 13, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jul 13, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten() function in libumsg.so.

AnalysisAI

Denial of service in MikroTik RouterOS 7.21.x (before 7.21.4) and 7.22.x (before 7.22.2) allows a remote unauthenticated attacker to crash the core inter-process communication layer by triggering an integer overflow in the unflatten() function of the bundled libumsg.so library. Successfully exploiting it disrupts device availability without touching data confidentiality or integrity. There is no public exploit identified at time of analysis, though a third-party research blog documents the underlying integer overflow; EPSS is low at 0.20% (10th percentile).

Technical ContextAI

RouterOS is MikroTik's Linux-based network operating system running on the vendor's routers, switches, and CHR virtual instances. The flaw lives in libumsg.so, the shared library implementing RouterOS's internal message-passing/IPC used to serialize and reconstruct structured messages. The unflatten() routine deserializes ('unflattens') a message buffer, and a CWE-190 integer overflow in its length/size handling lets attacker-controlled input miscompute a value - leading to memory corruption or an out-of-bounds condition that crashes the handling process. Because this IPC library backs core RouterOS services reachable over the network, a malformed message can take down the affected process and, by extension, device functionality.

RemediationAI

Vendor-released patch: upgrade RouterOS 7.21.x devices to 7.21.4 or later and 7.22.x devices to 7.22.2 or later, which contain the fix for the unflatten() integer overflow; consult MikroTik's advisory at https://mikrotik.com/supportsec for exact channel details. Where immediate patching is not possible, reduce exposure by restricting network reachability of RouterOS management and service ports to trusted management networks or VPN (firewall the WAN-facing services, e.g. via /ip firewall rules and the 'Allowed From' service restrictions), since the attack is network-reachable and unauthenticated - the trade-off is that overly broad filtering can disrupt legitimate remote administration and dynamic routing/IPC peers. Disabling or firewalling any unneeded RouterOS services further shrinks the attack surface. Technical background on the flaw is documented at https://zakpatrik.cz/blog/finding-an-integer-overflow-in-mikrotik-routeros-core-ipc-library.