# CVE-2026-89028

RouterOS SMB1 heap corruption via crafted SessionSetupAndX; possible RCE/DoS

- Page: https://www.vulneraibility.com/cve/CVE-2026-89028
- CVSS: 8.2
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.58% (percentile 47.8)
- CISA SSVC: exploitation none, automatable no, technical impact partial (assessed 2026-09-17)
- Weakness: CWE-122, CWE-191
- Published: 2026-09-16

## Affected versions

- MikroTik RouterOS: affected <= 6.49.18; >= 7.0.0 and <= 7.11.2; fixed in 7.24.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote heap memory corruption via crafted SMB1 SessionSetupAndX; may enable remote code execution or cause device crashes/DoS.

## Action

Immediate action required

## Recommendation

Update to RouterOS 7.24 and block SMB (TCP 445) from untrusted networks

## References

- [patch] https://forum.mikrotik.com/t/7-24-stable-is-released/272381
- [advisory] https://www.vulncheck.com/advisories/mikrotik-routeros-heap-corruption-via-smb1-sessionsetupandx

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.