What is CVE-2026-16347?

CVE-2026-16347 is a high-severity vulnerability in Mikrotik Cloud Hosted Router, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 8.8/10. Published 2026-07-28.

How severe is CVE-2026-16347?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Mikrotik Cloud Hosted Router

CVE-2026-16347

MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions…

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Mikrotik Cloud Hosted Router — versions All versions
Mikrotik Routeros — versions All versions

Weakness classification (CWE)

CWE-307 — Improper Restriction of Excessive Authentication Attempts

References

ics-cert@hq.dhs.gov (government-resource)

Frequently asked questions

What is CVE-2026-16347?: CVE-2026-16347 is a high-severity vulnerability in Mikrotik Cloud Hosted Router, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 8.8/10. Published 2026-07-28.
How severe is CVE-2026-16347?: High severity. CVSS v3 base score is 8.8 out of 10.