Is CVE-2026-16347 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16347 being exploited in the wild.

How severe is CVE-2026-16347?

High severity, with a CVSS score of 8.8, published 28 July 2026.

Which products and versions are affected?

MikroTik Cloud Hosted Router All versions; MikroTik RouterOS All versions.

Is there a fix for CVE-2026-16347?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16347 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-16347?

Check whether you run MikroTik Cloud Hosted Router or MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16347: MikroTik RouterOS improper restriction of excessive authentication attempts in API

CVE-2026-16347 · Severity: high · CVSS 8.8 · Published 2026-07-28

MikroTik RouterOS, the operating system used in MikroTik routers and cloud-based networking hardware, lacks effective protections against repeated login attempts on its management interface. This allows an attacker on the same local network to perform high-speed automated password guessing without being blocked or slowed down. If successful, an attacker could gain full administrative control over the router, potentially leading to data interception, network outages, or unauthorized access to the internal corporate network.

Technologies: MikroTik RouterOS. Vendors: MikroTik.

Quick answers

Is CVE-2026-16347 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16347 being exploited in the wild.
How severe is CVE-2026-16347?: High severity, with a CVSS score of 8.8, published 28 July 2026.
Which products and versions are affected?: MikroTik Cloud Hosted Router All versions; MikroTik RouterOS All versions.
Is there a fix for CVE-2026-16347?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16347 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-16347?: Check whether you run MikroTik Cloud Hosted Router or MikroTik RouterOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

MikroTik RouterOS is vulnerable to improper restriction of excessive authentication attempts (CWE-307) within its API service. The system fails to enforce meaningful rate-limiting, account lockouts, or source-based restrictions for failed logins. While some versions implement a fixed per-connection delay, this defense can be bypassed by initiating multiple concurrent sessions to maintain a high volume of attempts. An attacker with adjacent network access can exploit this to conduct brute-force attacks against administrative credentials. As of the advisory date, no official patch is available, and users are advised to restrict API access to trusted networks and use strong, complex passwords.

Affected products

MikroTik RouterOS All versions
MikroTik Cloud Hosted Router All versions

Timeline

2026-07-28: disclosed: Initial publication of ICS-CERT advisory ICSA-26-209-05
2026-07-28: advisory: NVD published CVE-2026-16347

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-05

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.