ICSA-26-209-05: MikroTik RouterOS and Cloud Hosted Router

CISA's summary

Advisory Summary: Successful exploitation of this vulnerability could allow attackers to rapidly guess passwords and gain unauthorized system access.

Products, as the advisory lists them

DeSpy has not checked any unit, hardware revision or firmware.

Vulnerabilities in this advisory

• CVE-2026-16347 · CWE-307

  MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.

Acknowledgments, as the advisory lists them

• Andre Santos, União Geek: reported this vulnerability to CISA

The advisory's legal notice

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Sources

• The advisory at cisa.gov
• The CSAF document (JSON)

DeSpy's copy of this version is dated 2026-09-28.