CVE-2026-16347 Overview
CVE-2026-16347 is a weakness in MikroTik RouterOS API authentication handling. The service lacks effective safeguards against excessive login attempts. RouterOS does not enforce meaningful rate-limiting, account lockout, or source-based restrictions on failed authentications. Some versions apply a fixed per-connection delay, but attackers can bypass it using concurrent sessions. The flaw maps to [CWE-307], improper restriction of excessive authentication attempts.
The issue was published to the National Vulnerability Database on 2026-07-28 and last modified on 2026-07-30. CISA published advisory ICSA-26-209-05 covering the weakness in operational technology environments.
Critical Impact
Attackers on an adjacent network can run high-volume credential guessing against RouterOS API endpoints and eventually obtain valid administrative credentials.
Affected Products
- MikroTik RouterOS (API service)
- RouterOS devices with the API port enabled and reachable on adjacent networks
- RouterOS versions where the per-connection delay can be bypassed via concurrent sessions
Discovery Timeline
- 2026-07-28 - CVE-2026-16347 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-16347
Vulnerability Analysis
RouterOS exposes an API service used for programmatic device administration. The authentication routine accepts repeated login attempts without progressive backoff, source-IP throttling, or account lockout. An attacker with adjacent network access can iterate through credential lists at scale.
Where a fixed per-connection delay exists, the delay applies only within a single TCP session. An attacker can open many concurrent sessions in parallel, each performing authentication attempts independently. The aggregate attempt rate scales linearly with the number of parallel connections, negating the intended defensive delay.
Because the API grants administrative control of the router when authentication succeeds, a successful brute-force yields full device compromise. This includes routing configuration, firewall rules, VPN termination, and traffic interception on any interface the router serves.
Root Cause
The root cause is a missing brute-force control on the API listener. RouterOS does not track failed authentications per source address or per account, and it does not lock accounts after a threshold. The per-connection delay is a local mitigation that does not maintain state across sessions, so concurrent connections escape any global rate ceiling.
Attack Vector
The attack vector is adjacent network access to the RouterOS API port (default TCP 8728, or 8729 for API-SSL). An unauthenticated attacker enumerates account names such as admin and submits large candidate password lists. The attacker parallelizes attempts across many TCP sessions to defeat the per-connection delay. When a valid credential is discovered, the attacker authenticates and issues administrative commands over the API.
No verified public exploit code is available. Refer to the CISA ICS Advisory ICSA-26-209-05 for vendor and coordination details.
Detection Methods for CVE-2026-16347
Indicators of Compromise
- High volumes of failed API authentication events in RouterOS logs on TCP 8728 or 8729
- Multiple concurrent TCP sessions to the API port originating from a single source or a small set of sources
- Successful API logins immediately following bursts of failed attempts against the same account
- Configuration changes, new user accounts, or new scheduler entries appearing shortly after authentication anomalies
Detection Strategies
- Ingest RouterOS syslog into a central log platform and alert on failed-login rate thresholds per source IP and per account
- Correlate concurrent TCP session counts to the API port with authentication failure spikes to catch parallelized guessing
- Baseline normal administrative access patterns and flag logins from unexpected source subnets or times
Monitoring Recommendations
- Forward RouterOS API and login logs to a SIEM or data lake with retention sufficient for post-incident review
- Monitor firewall counters on the API port for unusual connection rates from adjacent segments
- Track changes to /user, /ip firewall, and /system scheduler for unauthorized additions following authentication anomalies
How to Mitigate CVE-2026-16347
Immediate Actions Required
- Restrict the RouterOS API service to trusted management subnets using the /ip service address list
- Disable the API and API-SSL services on devices that do not require programmatic access
- Enforce strong, unique administrative passwords and remove or rename the default admin account
- Place management interfaces on an isolated out-of-band network unreachable from user or WAN segments
Patch Information
No specific fixed version is enumerated in the NVD record at the time of publication. Consult MikroTik advisories and the CISA ICS Advisory ICSA-26-209-05 for updated firmware guidance and apply the latest RouterOS release from the vendor.
Workarounds
- Add explicit firewall input rules to drop API traffic from all sources except a defined management address list
- Require certificate-based access through API-SSL only, and terminate management access behind a VPN
- Configure external rate-limiting on an upstream firewall to cap concurrent connections to the API port per source
# Configuration example: restrict RouterOS API to a management subnet
/ip service set api address=192.0.2.0/24 disabled=no
/ip service set api-ssl address=192.0.2.0/24 disabled=no
/ip service disable api
# Drop unsolicited API traffic at the input chain
/ip firewall filter add chain=input protocol=tcp dst-port=8728,8729 \
src-address-list=!mgmt-allow action=drop comment="Block API brute-force"
/ip firewall address-list add list=mgmt-allow address=192.0.2.0/24
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
