API Authentication Flaw in MikroTik RouterOS
CVE-2026-16347

8.7HIGH

Key Information:

Vendor

Mikrotik

Status
Routeros
Cloud Hosted Router
Vendor
CVE Published:
28 July 2026

What is CVE-2026-16347?

MikroTik RouterOS has a significant vulnerability in its API authentication process, which fails to implement adequate protections against excessive login attempts. The absence of robust rate-limiting and account lockout measures allows attackers to exploit this weakness by making high volumes of authentication attempts without triggering any security responses. While some versions may introduce a limited per-connection delay, this can easily be circumvented through simultaneous sessions. This presents a critical risk of credential compromise, potentially granting unauthorized access to administrative capabilities.

Affected Version(s)

Cloud Hosted Router All versions

RouterOS All versions

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
government-resource

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andre Santos of UniĂŁo Geek reported this vulnerability to CISA.
.