CVE-2026-16347

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS (affected versions not specified) MikroTik Cloud Hosted Router (affected versions not specified)

Description A weakness exists in the API authentication handling that lacks effective safeguards against excessive login attempts. The system fails to enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to occur without a defensive response. While some versions implement a fixed per-connection delay, this can be bypassed using concurrent sessions to maintain high-volume attempts, increasing the risk of unauthorized administrative access through credential discovery.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.