Advisories › MikroTik › ICSA-26-209-05
MikroTik RouterOS and Cloud Hosted Router: 1 CVE, High 8.8
Summary
CISA reports 1 vulnerability in MikroTik RouterOS, Cloud Hosted Router. Weakness type: Improper Restriction of Excessive Authentication Attempts. Successful exploitation of this vulnerability could allow attackers to rapidly guess passwords and gain unauthorized system access. Highest CVSS v3 score: 8.8 (High), exploitable from an adjacent network.
What to do: Prioritize: No fix is currently available from MikroTik. Until a fix is available, MikroTik recommends that users adopt the following mitigations: Use a strong VPN or other additional protection layer if the API is exposed to public networks.
At a glance
- Vendor
- MikroTik
- Products
- RouterOS, Cloud Hosted Router
- CVEs
- CVE-2026-16347
- Highest CVSS v3
- 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Information Technology, Commercial Facilities
- Deployed
- Worldwide
- Vendor HQ
- Latvia
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-16347 | Improper Restriction of Excessive Authentication Attempts | 8.8 | – | No | MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypass… |
Affected products (2)
- MikroTik RouterOS: vers:all/*
- MikroTik Cloud Hosted Router: vers:all/*
Vendor fixes and mitigations (from advisory)
- Mitigation: No fix is currently available from MikroTik. Until a fix is available, MikroTik recommends that users adopt the following mitigations: Use a strong VPN or other additional protection layer if the API is exposed to public networks.
- Mitigation: Configure the unsuccessful-attempt time range (0.1 to 0.5 seconds) in /ip service for all services, including the API, once available.
- Mitigation: Connect initially from a trusted network (LAN) port only, then configure the router per your security requirements.
- Mitigation: Restrict/limit access to management services from untrusted networks.
- Mitigation: Apply firewall rules to control and restrict access to management services where possible.
- Mitigation: Use long, randomly generated passwords rather than weak or default-simple ones, to keep the brute-force search space impractically large.
- Mitigation: Keep the default randomly generated device password, or replace it with an equally strong one, since minimum complexity isn't enforced by default.
- Mitigation: Users are encouraged to reach out to MikroTik (https://mikrotik.com/support) for further support. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.