CVE-2026-16347
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts.
Risk Assessment
The organization is at risk that an attacker could obtain valid credentials through brute-force attacks and gain unauthorized access to RouterOS administrative services.
Recommendation
Implement additional security measures such as restricting API access to trusted IP addresses, enabling logging and monitoring of login attempts, and consider upgrading to a patched version if available.
Other vulnerabilities in MikroTik RouterOS
See all- CVE-2024-27686High
Mikrotik RouterOS versions 6.40.5 through 6.49.10 (fixed in 7) allow a remote attacker to cause a device crash via crafted packet data to the SMB service on TCP port 445.
- CVE-2026-14227Medium
A product with the MikroTik RouterOS API enabled is vulnerable to insufficient session expiration. Active sessions may retain their previous permission set after inactivity timeouts or user-group changes.
- CVE-2026-39042High
A vulnerability in MikroTik RouterOS versions 7.21.x before 7.21.4 and 7.22.x before 7.22.2 exists in the unflatten() function of the libumsg.so library. A remote attacker can exploit this flaw to cause a denial of service (DoS).
- CVE-2023-47310Medium
A misconfiguration in the default settings of MikroTik RouterOS 7 allows incoming IPv6 UDP traceroute packets. The issue is fixed in version v7.14.
- CVE-2023-24094High
A vulnerability in the bridge2 component of MikroTik RouterOS version 6.40.5 allows attackers to cause a Denial of Service (DoS) by sending crafted packets.
Original NVD description (English source)
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.