MikroTik RouterOS and Cloud Hosted Router

CISA has published an ICS advisory regarding a high-severity vulnerability (CVE-2026-16347) affecting MikroTik RouterOS and Cloud Hosted Router (all versions). The vulnerability stems from improper restriction of excessive authentication attempts in the API authentication handling, lacking effective rate-limiting, account lockout, or source-based restrictions. Attackers on adjacent networks can bypass a fixed per-connection delay by using concurrent sessions, enabling high-volume brute-force password guessing. The CVSS v3.1 score is 8.8 (HIGH), with attack vector adjacent network, no privileges required, and high impact on confidentiality, integrity, and availability. No patch is currently available from MikroTik. Mitigations include using VPNs, restricting API access to trusted networks, applying firewall rules, and using strong randomly generated passwords. The vulnerability was reported by Andre Santos of União Geek. No known public exploitation has been reported at this time, and the vulnerability is not remotely exploitable.