What’s Vulnerable › Vulnerabilities
CVE-2026-16347: Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-28 · updated 2026-07-30
- Weakness: CWE-307
Description
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.
Affected products
- MikroTik Cloud Hosted Router: all versions
- MikroTik RouterOS: all versions
References
Get alerted when CVE-2026-16347 or the next vulnerability affects your stack