Quick answers
- Is CVE-2026-89020 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-89020 being exploited in the wild.
- How severe is CVE-2026-89020?
- Medium severity, with a CVSS score of 4.3, published 14 September 2026.
- Which products and versions are affected?
- MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable).
- Is there a fix for CVE-2026-89020?
- A patch was published on 2026-09-03: Patches released in RouterOS 7.23.4 (long-term) and 7.24.2 (stable) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-89020 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-89020?
- Check whether you run MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stack-based buffer overflow in the mtget binary's TFTP RRQ (read request) builder function. The 528-byte stack buffer is overflowed when a URL path exceeds 507 bytes, causing an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset. An authenticated attacker with read-only group membership can trigger the overflow by issuing a /tool fetch command with a crafted tftp:// URL path; no reachable TFTP server or elevated privileges are required. The overflow crashes the mtget worker process but does not enable code execution. Patches are available in RouterOS 7.23.4 (long-term) and 7.24.2 (stable).
Affected products
- MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable)
Timeline
- 2026-09-14: disclosed
- 2026-09-03: patched: Patches released in RouterOS 7.23.4 (long-term) and 7.24.2 (stable)