MikroTik RouterOS Faces CVSS 8.8 Brute-Force Flaw, No Fix Yet
Every version of RouterOS and Cloud Hosted Router is affected, and the mitigations rely on network isolation and credential hardening; no code fix ships today.
TL;DR
CISA published ICSA-26-209-05 for CVE-2026-16347, an 8.8-severity vulnerability in all versions of MikroTik RouterOS and Cloud Hosted Router. The API authentication handling lacks rate-limiting on login attempts, letting attackers brute-force credentials for administrative access. No vendor fix is available. Recommended mitigations (VPN wrapping, firewall rules, LAN-only configuration, long random passwords) are all operator-side controls. The one software-side mitigation, unsuccessful-attempt timing in /ip service, is listed as available only in a future release. The vulnerability is not remotely exploitable per the CVSS vector.
The ICS advisory covers every version of both MikroTik RouterOS and Cloud Hosted Router. There is no patched release. The CVSS 3.1 score is 8.8, with a vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) that tells the story: an attacker on an adjacent network faces no meaningful barrier to repeated login attempts. In some versions a fixed per-connection delay exists, but CISA notes it can be bypassed through concurrent sessions.
MikroTik's recommended mitigations reward close reading. They include wrapping the API in a VPN, restricting management access from untrusted networks via firewall rules, connecting from a trusted LAN port first, and using long randomly generated passwords. One item, configuring an unsuccessful-attempt time range of 0.1 to 0.5 seconds in /ip service, carries the qualifier "once available," which suggests it may ship in a future release. For now, it isn't available. The mitigations that work today are operator-side controls, not firmware updates. Every one requires hands-on configuration per device.
For the practitioner, Monday starts with an inventory question: where are MikroTik devices sitting, and what can reach their management interfaces? CISA states the vulnerability is not remotely exploitable, but the advisory also warns about API exposure to public networks and recommends VPN wrapping. The practical risk turns on architecture. If the management interface is reachable from a compromised host or an untrusted segment, the brute-force math favors the attacker. CISA reports no known public exploitation targeting this vulnerability, but that's a point-in-time observation.
Published ·Deep Fathom