CVE-2026-16347: mikrotik cloud hosted router

Vulnerability summary

CVE-2026-16347 is a high (CVSS 8.8) vulnerability in mikrotik cloud hosted router. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.4% of scored vulnerabilities.

Timeline

1. 28-07-2026
   PublishedVulnerability first disclosed.
2. 29-07-2026
   Last modifiedVulnerability information updated.

Description

MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.

• CWE-307Improper Restriction of Excessive Authentication AttemptsThe product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.