Firewall and Router Ledger 2026
Ledger
Firewall and Router Ledger 2026
RouterOS: Firewall and Router Ledger 2026 Scorecard
RouterOS gives deep routing and perpetual low-cost licences on any x86 VM, with no threat engine and three KEV entries in September 2026.
Edition October 16, 20268 min read
Where MikroTik RouterOS put its effort, 2016 to 2026
Each square is one capability area in one year. The brighter it is, the more the area gained in the Firewall and Router Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
| ’16 | ’17 | ’18 | ’19 | ’20 | ’21 | ’22 | ’23 | ’24 | ’25 | ’26 | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Routing and WAN | 1 | ||||||||||
| Firewall and NAT core | |||||||||||
| VPN and remote access | 2 | ||||||||||
| Threat protection | |||||||||||
| Network services | |||||||||||
| Platform and hypervisor freedom | 1 | ||||||||||
| High availability and performance | |||||||||||
| Management, API and automation | 3 | ||||||||||
| Observability | |||||||||||
| Platform security and lifecycle |
no change+0.5+1+1.5 or moreScores out of 5 per area.
Biggest pushes overall: Routing and WAN (+0.5), VPN and remote access (+0.5), Platform and hypervisor freedom (+0.5). Already strong in 2015: Routing and WAN, Firewall and NAT core, Network services.
Top focus each year: 2016 Platform and hypervisor freedom; 2021 Routing and WAN. 9 of 11 years show no gain in any area.
Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.
Snapshot
- Type: product
- Owner: SIA Mikrotikls (MikroTik), Riga, Latvia; private company registered in 1996, founder-owned per secondary sources; no acquisitions found
- Licence: Proprietary, closed source. Perpetual licence levels that never expire with free upgrades: x86 Level 4 $45, Level 5 $95, Level 6 $250; CHR Free (1 Mbps per interface), P1 $45 (1 Gbps), P10 $95 (10 Gbps), P-Unlimited $250 with a 60 day trial; CHR levels limit throughput only
- Latest release: 7.24 stable (changelog 2026-08-14) with point releases to 7.24.3; 7.23.8 long-term and 6.49.23 both on 2026-10-09
- Support lifecycle: Long-term, Stable, Testing and Development channels; the v6 and v7 lines both still receive releases; in-place package upgrades; no published support windows
- Next milestone: none published (7.25 and 7.26 manuals exist without dates)
- Security record: 3 CISA KEV entries since 2023, all in September 2026: CVE-2026-86060 (SSH argument delimiter flaw, privilege escalation) and CVE-2026-67277 (btest missing authentication) added 2026-09-10, CVE-2026-67279 (SSH unauthenticated exec request, exploited in the wild per MikroTik) added 2026-09-25. Fixed in 7.24.2, 7.23.4 and 6.49.21; the related CVE-2026-67278 fix was completed in 7.24.3 and 7.23.6. Advisories: https://mikrotik.com/supportsec
- Hypervisors: CHR tested on VMware ESXi 6.5 and later, QEMU/KVM, Hyper-V Generation 1, Xen Server 7.1 and VirtualBox 6, with install guides for Proxmox VE, AWS, Google Compute Engine, Linode, Hetzner and Vultr; XCP-ng and Azure not named; CHR is x86-64 only and ARM runs only on MikroTik hardware
- Tier: Router operating system
- Archetype: Dependable builder
- Evidence grade: B. The CHR page, the licence level table, the changelog list, the September 2026 vulnerability page and the CISA catalogue were read from primary sources. The 7.20 to 7.24 contents come from MikroTik forum release threads. The 2015 baseline rests on the undated licence feature table, and the v6 and early v7 feature history was not itemised, so steps before 2021 are inferred. Ownership and revenue figures come from secondary sources.
Scope of the scores: RouterOS is sold mostly on MikroTik hardware, but the x86 install licence and the Cloud Hosted Router (CHR) image make it a software product too, so it is scored here. The hardware-coupled flag applies to the ecosystem, and ARM builds exist only for MikroTik boards.
Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 57.6 / 100 | higher is better |
| Momentum since end of 2022 | -3.0 points (2015 to 2022: +4.4) | higher is better |
| Credibility | 16.0 / 25 | higher is better |
| Commercial risk | 4.5 / 25 | lower is better |
| Technical lock-in | 11.5 / 25 | lower is better |
| Integrator fit | 11.5 / 20 | higher is better |
| AI leverage | 1.5 / 20 | higher is better |
| Ledger Index | 53.1 / 100 | balanced weights; see the methodology |
Capability by domain, 2015 to today
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2015 | 2019 | 2022 | Today |
|---|---|---|---|---|
| Routing and WAN (12) | 3.5 | 3.5 | 4 | 4 |
| Firewall and NAT core (12) | 3.5 | 3.5 | 3.5 | 3.5 |
| VPN and remote access (12) | 3 | 3 | 3.5 | 3.5 |
| Threat protection (12) | 0.5 | 0.5 | 0.5 | 0.5 |
| Network services (8) | 3.5 | 3.5 | 3.5 | 3.5 |
| Platform and hypervisor freedom (10) | 3 | 3.5 | 3.5 | 3.5 |
| High availability and performance (8) | 3 | 3 | 3 | 3 |
| Management, API and automation (10) | 3 | 3 | 3.5 | 3.5 |
| Observability (6) | 3 | 3 | 3 | 3 |
| Platform security and lifecycle (10) | 2.5 | 2.5 | 2.5 | 1 |
| Total / 100 | 56.2 | 57.2 | 60.6 | 57.6 |
Year by year: 2015: 56.2 · 2016: 57.2 · 2017: 57.2 · 2018: 57.2 · 2019: 57.2 · 2020: 57.2 · 2021: 60.6 · 2022: 60.6 · 2023: 60.6 · 2024: 60.6 · 2025: 60.6 · 2026: 57.6
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2016 | Platform and hypervisor freedom | 3 → 3.5 | +1.0 | CHR image for ESXi, KVM, Hyper-V Generation 1, Xen and VirtualBox with Proxmox VE, AWS and Google Compute Engine guides (CHR introduction year not sourced in the dossier); no arm64 CHR, no Azure image, no DPDK or SR-IOV |
| 2021 | Management, API and automation | 3 → 3.5 | +1.0 | 7.1: REST API alongside the binary API (version not confirmed in the dossier); Terraform and Ansible content is community-maintained; no central multi-site policy console verified |
| 2021 | Routing and WAN | 3.5 → 4 | +1.2 | 7.1: rewritten BGP and OSPF, new IPv6 stack, MPLS carried over; EVPN exists in v7 (introduction release not sourced); still no SD-WAN style path selection with health probes |
| 2021 | VPN and remote access | 3 → 3.5 | +1.2 | 7.1: WireGuard; no ZTNA client, no MFA integration found |
| 2026 | Platform security and lifecycle | 2.5 → 1 | -3.0 | KEV deduction: CVE-2026-86060 and CVE-2026-67277 added 2026-09-10, CVE-2026-67279 added 2026-09-25 (minus 1.5) |
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2023-05 | 6.48.7 and 6.49.8 long-term releases keep the v6 line maintained alongside v7 | Security and lifecycle | C |
| 2023-09 | 6.49.10 long-term release | Security and lifecycle | C |
| 2024-04 | 6.49.13 long-term release; v7 point releases of 2023 and 2024 were not itemised in the research | Security and lifecycle | C |
| 2025-02 | 6.49.18 and later 6.49.19 (2025-07) long-term releases | Security and lifecycle | C |
| 2025-09 | 7.20: routing filter wizard, liberal TCP tracking, Aquantia driver for arm64, x86 and CHR | Routing | C |
| 2026-01 | 7.21: receive packet steering on arm64, eBGP duplicate router-id handling, OSPF NSSA default change | Routing | C |
| 2026-05 | 7.23: HTTPS by default for upgrade servers, outbound control for containers | Security and lifecycle | C |
| 2026-05 | 7.23: lossless QoS classes | High availability | C |
| 2026-08 | 7.24: post-quantum SSH key exchange, masking of sensitive fields | Security and lifecycle | V |
| 2026-08 | 7.24: privileged containers with RKE2 | Platform | V |
| 2026-08 | 7.24: VRF in offloaded switch features, BGP EVPN fix, WireGuard peer fixes | Routing | C |
| 2026-08 | 7.24: DHCPv4 snooping table | Network services | C |
| 2026-09 | September 2026 disclosure of six vulnerabilities reported by CERT.pl, one exploited in the wild; fixes in 7.24.2, 7.23.4 and 6.49.21 | Security and lifecycle | C |
| 2026-10 | 7.24.3 and 7.23.6 complete the CVE-2026-67278 fix; 2026-10-06 advisories include a critical WebFig flaw (CVE-2026-84411) | Security and lifecycle | C |
- Centre of gravity: Security and lifecycle (8), Routing (3), High availability (1)
- Blind spots (no items): Firewall core, VPN, Threat protection, Management and API, Observability, Packaging, Licensing, AI
- Driver mix: Vision 14%, Customer need 86%, Market window 0%, Upstream 0%, Portfolio 0%
- Idea-to-need index: 0.14 (0 = demand-pulled, 1 = thesis-pushed)
Credibility: 16.0 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 3.5 | Stable and long-term point releases every few weeks (7.24 on 2026-08-14, 7.23.8 and 6.49.23 on 2026-10-09); no published schedule |
| Roadmap transparency | 2.5 | Detailed public changelogs and public beta threads on the forum; no roadmap page and no stated direction beyond beta changelogs |
| Say-do | 2.5 | MikroTik announces almost nothing in advance; v7 spent about two years in beta before 7.1 shipped on 2021-12-01, and the CVE-2026-67278 fix needed a second release |
| Velocity | 4 | 7.20 to 7.24 brought a routing filter wizard, packet steering, container controls, post-quantum SSH and VRF offload within one year |
| Lifecycle stability | 3.5 | v6 still receives releases five years after v7 shipped, a long-term channel exists and upgrades are in place; support windows are not published |
Commercial risk: 4.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 0.5 | No change found since 2023; the published levels (x86 $45, $95, $250; CHR $45, $95, $250) sit on undated pages |
| Purchase constraints | 1 | Perpetual licences in any quantity, a free CHR level and a Level 1 demo; an x86 licence level cannot be changed after purchase |
| Channel and access | 1 | Open downloads and free patches without a subscription; sold through distributors and the MikroTik store; partner terms not published |
| Owner stability | 1.5 | Founder-owned private company since 1996 with no acquisitions; a single mid-sized company is the dependency |
| Cost of staying supported | 0.5 | Licences never expire and all upgrades are free |
Technical lock-in: 11.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 3 | Configuration lives as RouterOS script export text; binary backups are tied to the version |
| Export path | 3 | The text export is readable but no converter to or from other vendors exists |
| Stack coupling | 1 | Runs alone; no management cloud required |
| Hardware / cloud coupling | 1.5 | CHR runs on any x86 hypervisor fully offline; ARM only on MikroTik hardware |
| Skills and tooling coupling | 3 | RouterOS syntax and Winbox are vendor specific, though trained people are plentiful |
Integrator fit: 11.5 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 3 | Distributor network, certified consultants and training partners; programme terms not published |
| Multi-tenancy and self-service | 1.5 | VRFs and User Manager; no multi-tenant console or self-service portal |
| API and infrastructure-as-code | 3 | REST API and binary API cover the configuration; Terraform and Ansible content is community-maintained |
| Skills and certification | 4 | MikroTik runs its own multi-level certification track (programme page not fetched) |
AI leverage: 1.5 / 20
How the product uses AI, scored per year like capability. Only GA counts.
| Criterion | 2019 | 2022 | Today | Latest step |
|---|---|---|---|---|
| AI in threat detection | 0 | 0 | 0 | 2015: None |
| AI platform stack | 0 | 0 | 0 | 2015: None |
| AI-assisted operations | 0 | 0 | 0 | 2015: None |
| Agent openness | 1 | 1.5 | 1.5 | 2021: 7.1: REST API; third-party MCP servers (vesact/mikrotik-mcp, MikroMCP) build on it, no official one |
Year by year: 2015: 1 · 2016: 1 · 2017: 1 · 2018: 1 · 2019: 1 · 2020: 1 · 2021: 1.5 · 2022: 1.5 · 2023: 1.5 · 2024: 1.5 · 2025: 1.5 · 2026: 1.5
AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI items were announced from 2023 to 2026.
RouterOS has no AI in threat detection, no assistant and no AI platform. Its REST API is open enough that community MCP servers exist, and that is the whole AI story.
Reading
RouterOS scores on what network engineers buy it for: BGP, OSPF, MPLS, VRFs and queues, licensed once for a few dollars and running on any x86 hypervisor through CHR. It loses most of its points in threat protection, where there is no engine at all, and in the security record, where three CISA KEV entries in September 2026 including one exploited SSH flaw take 1.5 points off the lifecycle line. The buyer-side numbers are among the lowest risks in the Ledger because licences never expire and patches are free. The one thing a buyer should check is the patch process: the same month produced an incomplete fix and a critical WebFig flaw, and MikroTik publishes no support windows, so someone has to own the update cadence. Treat it as a router with a stateful firewall, and pair it with a separate IPS if threat protection matters.
Open questions and items to re-score
- Status and dates of 7.25 and 7.26; the manuals exist but no release notes or dates were found.
- The CHR introduction year and the version that added the REST API were not sourced in the dossier; both steps are dated from memory of the product history and marked as such.
- Release dates for DNS over HTTPS, 802.1X and BGP EVPN were not sourced; a sourced date could lift the services and routing lines by half a step.
- Whether CVE-2026-86060 and CVE-2026-67279 affect CHR deployments in the same way as hardware routers.
- No Azure image was found on the CHR page; XCP-ng is not named.
- The v7 feature history for 2023 to 2025 (7.8 to 7.19) was not itemised, so the direction list leans on v6 maintenance releases for 2023 and 2024.
- Advisories for 2023 and 2024 were not visible on the MikroTik security page at the time of research.
- Ownership split and revenue figures come from Wikipedia and a company aggregator, not from MikroTik.
Related reading
More from Firewall and Router Ledger 2026
- Overview: all platforms side by side
- Firewall and Router Ledger Methodology: How Every Score Is Built
- Barracuda: Firewall and Router Ledger 2026 Scorecard
- Check Point: Firewall and Router Ledger 2026 Scorecard
- Cisco FTD: Firewall and Router Ledger 2026 Scorecard
- Forcepoint NGFW: Firewall and Router Ledger 2026 Scorecard
- FortiGate: Firewall and Router Ledger 2026 Scorecard
- IPFire: Firewall and Router Ledger 2026 Scorecard
- Juniper vSRX: Firewall and Router Ledger 2026 Scorecard
- Netgate TNSR: Firewall and Router Ledger 2026 Scorecard
- NG Firewall: Firewall and Router Ledger 2026 Scorecard
- OpenWrt: Firewall and Router Ledger 2026 Scorecard
- OPNsense: Firewall and Router Ledger 2026 Scorecard
- Palo Alto: Firewall and Router Ledger 2026 Scorecard
- pfSense: Firewall and Router Ledger 2026 Scorecard
- SonicWall NSv: Firewall and Router Ledger 2026 Scorecard
- Sophos Firewall: Firewall and Router Ledger 2026 Scorecard
- VyOS: Firewall and Router Ledger 2026 Scorecard
- WatchGuard: Firewall and Router Ledger 2026 Scorecard