Vulnerability · Published Jul 28, 2026 · Assigned by icscert
CVE-2026-16347Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router
High 8.8
In plain English
A high-severity security flaw in Cloud Hosted Router from MikroTik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MikroTik | RouterOS | All versions |
| MikroTik | Cloud Hosted Router | All versions |
Weakness: CWE-307 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-05 government-resource