CVE-2026-16347

CVE-2026-16347 describes a vulnerability within MikroTik RouterOS and Cloud Hosted Router that impacts their API authentication handling. The core issue stems from a lack of effective safeguards against excessive login attempts. Specifically, the system does not implement meaningful rate-limiting, account lockout mechanisms, or source-based restrictions to prevent repeated authentication failures. Although some versions of the affected software include a fixed per-connection delay, this can be circumvented through the use of concurrent sessions, enabling attackers to continue high-volume authentication attempts. This deficiency significantly elevates the risk of an attacker successfully acquiring valid credentials and subsequently gaining unauthorized access to administrative services.