CVE CVE-2026-112158
Severity MEDIUM · CVSS 3.1 6.5 · CVSS 4.0 7.1
Weakness CWE-189, CWE-190
Affected versions 6.0, 6.1, 6.10, 6.11, 6.12, 6.13, 6.14, 6.15, 6.16, 6.17, 6.18, 6.19, 6.2, 6.20, 6.21, 6.22, 6.23, 6.24, 6.25, 6.26, 6.27, 6.28, 6.29, 6.3, 6.30, 6.31, 6.32, 6.33, 6.34, 6.35, 6.36, 6.37, 6.38, 6.39, 6.4, 6.40, 6.40.0, 6.40.1, 6.40.2, 6.40.3, 6.40.4, 6.40.5, 6.41, 6.42, 6.43, 6.44, 6.5, 6.6, 6.7, 6.8, 6.9, 7.20.0, 7.20.1, 7.20.2, 7.20.3, 7.20.4, 7.20.5, 7.20.6, 7.20.7, 7.20.8
Fixed version 7.21.5, 7.23.1
Actively exploited No, as of the date of this article
CISA Advisory none
Published 2026-10-19

What is the CVE-2026-112158 vulnerability?

This is an Integer Overflow or Wraparound weakness (CWE-190) identified in the same_check function of the ipt_SAME.ko file. A remote attacker can manipulate data to trigger an integer overflow, resulting in a high impact on system availability. The CVSS v3.1 score is 6.5 (MEDIUM), while the CVSS v4.0 score is 7.1 (HIGH).

Which RouterOS versions are vulnerable?

All versions of the 6.x series (from 6.0 to 6.44) and versions 7.20.0 through 7.20.8 are affected. The indicated fixed versions are 7.21.5 and 7.23.1.

Is my router at risk?

Your router is exposed if it runs a RouterOS version between 6.0 and 6.44 or between 7.20.0 and 7.20.8, and the ipt_SAME.ko module is active. Since the attack can be launched remotely, the risk exists if the router is reachable from untrusted networks.

Is the CVE-2026-112158 vulnerability actively exploited?

As of the date of this article, the vulnerability is not listed in the CISA KEV catalog, and there are no reports of active exploitation by ENISA.

How to protect your router from CVE-2026-112158?

The only effective mitigation is updating the firmware to versions 7.21.5 or 7.23.1. No alternative temporary mitigations have been communicated by the vendor.

Which RouterOS commands are needed to mitigate CVE-2026-112158?

Update RouterOS

The only definitive fix is an update. First, save your configuration; the installation will reboot the router.

# 1. salva configurazione e backup
/export file=prima-aggiornamento
/system backup save name=prima-aggiornamento
# 2. scegli il canale (long-term o stable) e controlla la versione disponibile
/system package update set channel=stable
/system package update check-for-updates
# 3. installa: ATTENZIONE, il router si riavvia
/system package update install
# 4. dopo il riavvio, aggiorna anche il firmware (RouterBOOT) e riavvia di nuovo
/system routerboard upgrade

Frequently asked questions

What is the CVSS score for CVE-2026-112158?

The CVSS v3.1 score assigned to CVE-2026-112158 is 6.5, classified as MEDIUM. The CVSS v4.0 score is 7.1, classified as HIGH.

Which RouterOS versions fix CVE-2026-112158?

The RouterOS versions that fix CVE-2026-112158 are 7.21.5 and 7.23.1.

Does CVE-2026-112158 require authentication to be exploited?

Yes, the CVSS attack vector indicates that the attack requires low privileges (PR:L), so authentication is necessary but does not need to be at the administrative level.

In which RouterOS component is the CVE-2026-112158 vulnerability located?

The CVE-2026-112158 vulnerability is located in the same_check function of the ipt_SAME.ko kernel file.

Official sources