MikroTik RouterOS API Authentication Brute-Force Vulnerability (CVE-2026-16347)
First seen Jul 29, 2026 · Updated Jul 29, 2026 · CVSS 8.8
MikroTik RouterOS and Cloud Hosted Router contain a flaw in API authentication handling that fails to enforce rate-limiting or account lockout, allowing attackers to conduct high-volume brute-force login attempts, including bypassing per-connection delays via concurrent sessions. Successful exploitation could grant unauthorized administrative access to the affected router. No public exploitation has been reported and the vulnerability requires adjacent network access, not remote internet-based exploitation.
Technical Analysis
CVE-2026-16347 (CVSS 3.1: 8.8, CVSS 4.0: 8.7) is an Improper Restriction of Excessive Authentication Attempts vulnerability (CWE-307) affecting all versions of MikroTik RouterOS and Cloud Hosted Router. The API service lacks meaningful rate-limiting or lockout mechanisms; while some versions implement a fixed per-connection delay, attackers can bypass this by opening multiple concurrent sessions to sustain high-volume credential guessing attacks. The attack vector requires adjacent network access (AV:A) with low complexity and no privileges or user interaction, and successful exploitation yields full confidentiality, integrity, and availability impact on the device. Organizations running AI agents or automation frameworks that use MikroTik routers for network infrastructure, VPN termination, or API-driven network management should treat compromised router credentials as a potential path to intercepting or manipulating traffic to agent backends, RAG data sources, or API keys transiting the network, making this agent-relevant where such devices sit in the agent's network path.
Affected Systems
MikroTik RouterOS (all versions), MikroTik Cloud Hosted Router (all versions), specifically the API authentication service under /ip service
Indicators of Compromise
- No known IOCs; no public exploitation reported at time of advisory
Remediation Steps
- 1
Restrict API exposure
Do not expose the RouterOS API to public/untrusted networks; require a strong VPN or additional protection layer for remote access.
- 2
Configure authentication delay
Set the unsuccessful-attempt time range (0.1 to 0.5 seconds) in /ip service for all services including the API, once a vendor fix is available.
- 3
Initial trusted-network configuration
Perform initial device configuration only from a trusted LAN port before exposing management services elsewhere.
- 4
Firewall and access restriction
Apply firewall rules to limit access to management services and restrict access from untrusted networks.
- 5
Strong password policy
Use long, randomly generated passwords and retain or replace the default randomly generated device password with an equally strong one, since minimum complexity is not enforced by default.
- 6
Monitor for brute-force activity
Monitor authentication logs for repeated failed login attempts and unusual concurrent session activity against management interfaces.
- 7
Vendor engagement
Contact MikroTik support for updates and apply a patch as soon as one becomes available, since no fix currently exists.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.