Administration › Firmware & Advisories is the one place that answers three questions for the MikroTik fleet: which RouterOS release should every device run, which release does each device actually run, and which published vulnerabilities apply to the versions in the field. Updates are started from the device, not from this page — the page tells you where to start.
Covers the MikroTik devices the platform manages: subscriber CPE (hAP ax S, hEX S) and the site routers registered with a host and a credential set. Switches are not RouterOS devices and are not on this page.

​
What the page shows

One target per RouterOS line — long-term (the CPE fleet runs long-term) and stable (site routers follow stable). Set the version here after a MikroTik release or advisory; every “outdated” badge on the platform compares against these two values. The card names the scope so you can see at a glance which devices each target applies to.
Every CPE model with the versions running on it, the count per version and the devices below the target. A device’s version is read once a day over the management path and on every Refresh now; a device that could not be read keeps its last known version and the time it was last checked.
The routers registered under a site with a host and a credential set, with the version they report, read once a day and on Refresh versions. The card compares each router against the target for the line it runs and against the advisories. Site routers are updated manually by the NOC — the page shows the state, it does not push packages to a router.
Published RouterOS vulnerabilities with their affected version ranges, the version that fixes them, the severity and whether they are on the CISA Known Exploited Vulnerabilities list. The list is synced once a day from the NVD CVE API and the CISA KEV catalogue (Sync now runs it on demand, it takes up to a minute). Each advisory shows how many CPEs and how many site routers are currently exposed. You can add an advisory by hand — for a vendor notice that has no CVE yet, for example; the form names every field.
The RouterOS packages staged on the platform for the target versions: fetched from MikroTik’s download server by version and architecture, or uploaded by hand when the platform has no internet path. A device update only works when every package the device has installed (system plus the Wi-Fi package on a hAP ax S) is staged for the target version — the card marks what is missing.

​
Keeping the fleet patched

1

Set the targets

After a MikroTik advisory: read the fixed version for each line, set long-term and stable on the release-targets card. From that moment every device below the target is counted as outdated on this page, on CPE Fleet and on each device’s panel.
2

Stage the packages

On the release-packages card, fetch the target version for every architecture in the fleet (arm for the hAP ax S, mmips for the hEX S) or upload the files. The card lists what is staged and what a model still needs.
3

Check who is exposed

Run Sync now on the advisories card if the advisory is newer than the last sync, then read the exposed counts. Devices below the target links to the devices to update first.
4

Update a CPE from its panel

Open the device (from CPE Fleet or the customer’s location) and use Update on its panel. The platform exports the device configuration first, copies the staged packages to the device, reboots it and reads the version back. The device is offline for two to three minutes; the customer loses Wi-Fi and internet for that time — pick a quiet moment, no maintenance window is needed. The panel shows the run (export → packages → reboot → verify) and keeps the last runs with their outcome; the exported configuration can be downloaded from a finished run.
5

Site routers

Read the version on the site-routers card, update the router the NOC’s way (backup, upgrade, verify), then Refresh versions — the card turns green once the router reports the target.

​
Good to know

  • The bench follows the target. New devices are flashed at the bench with the long-term target, so a target change reaches new devices automatically; devices already in the field need the update from the panel.
  • All packages move together. RouterOS refuses a partial upgrade — if a model’s Wi-Fi package is not staged for the target, the update is not offered for that model.
  • Lab runs are dry runs. Outside production the update records what it would do without touching the device; the run is marked as a dry run.
  • Do not update during an install. A technician waiting for the “device online” signal should not see it disappear because of a reboot — update before or after the visit.
  • What to report after an advisory: device name, version before, version after, status — the fleet card and the device history carry all four.

​
Troubleshooting