{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-16347", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-07-20T20:41:22.596Z", "datePublished": "2026-07-28T19:59:29.927Z", "dateUpdated": "2026-07-29T13:57:56.713Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-07-28T19:59:29.927Z" }, "title": "Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router", "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-307", "description": "CWE-307 Improper restriction of excessive authentication attempts", "type": "CWE" } ] } ], "affected": [ { "vendor": "MikroTik", "product": "RouterOS", "versions": [ { "status": "affected", "version": "All versions" } ], "defaultStatus": "affected" }, { "vendor": "MikroTik", "product": "Cloud Hosted Router", "versions": [ { "status": "affected", "version": "All versions" } ], "defaultStatus": "affected" } ], "descriptions": [ { "lang": "en", "value": "MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services. 
" } ] } ], "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-05", "tags": [ "government-resource" ] } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV3_1": { "version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } }, { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } } ], "workarounds": [ { "lang": "en", "value": "No fix is currently available from MikroTik. Until a fix is available, MikroTik recommends that users adopt the following mitigations: Use a strong VPN or other additional protection layer if the API is exposed to public networks.\n\n* Configure the unsuccessful-attempt time range (0.1 to 0.5 seconds) in /ip service for all services, including the API, once available.\n\n* Connect initially from a trusted network (LAN) port only, then configure the router per your security requirements.\n\n* Restrict/limit access to management services from untrusted networks.\n\n* Apply firewall rules to control and restrict access to management services where possible.\n\n* Use long, randomly generated passwords rather than weak or default-simple ones, to keep the brute-force search space impractically large.\n\n* Keep the default randomly generated device password, or replace it with an equally strong one, since minimum complexity isn't enforced by default.\n\n\n\nUsers are encouraged to reach out to MikroTik (https://mikrotik.com/support) for further support.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "No fix is currently available from MikroTik. Until a fix is available, MikroTik recommends that users adopt the following mitigations: Use a strong VPN or other additional protection layer if the API is exposed to public networks.\n
* Configure the unsuccessful-attempt time range (0.1 to 0.5 seconds) in /ip service for all services, including the API, once available.\n
* Connect initially from a trusted network (LAN) port only, then configure the router per your security requirements.\n
* Restrict/limit access to management services from untrusted networks.\n
* Apply firewall rules to control and restrict access to management services where possible.\n
* Use long, randomly generated passwords rather than weak or default-simple ones, to keep the brute-force search space impractically large.\n
* Keep the default randomly generated device password, or replace it with an equally strong one, since minimum complexity isn't enforced by default.\n
\n
Users are encouraged to reach out to MikroTik (https://mikrotik.com/support) for further support. " } ] } ], "credits": [ { "lang": "en", "value": "Andre Santos of União Geek reported this vulnerability to CISA.", "type": "finder" } ], "source": { "discovery": "UNKNOWN" }, "x_generator": { "engine": "Vulnogram 1.0.4" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-07-29T13:57:29.902200Z", "id": "CVE-2026-16347", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T13:57:56.713Z" } } ] } }