MikroTik RouterOS and Cloud Hosted Router Vulnerability Advisory

MikroTik RouterOS and Cloud Hosted Router Vulnerability Advisory 🚨

CISA has published an advisory regarding a critical vulnerability in MikroTik RouterOS and Cloud Hosted Router. This vulnerability could allow attackers to rapidly guess passwords and gain unauthorized system access.

Key Details:

• Vulnerability: Weakness in API authentication handling.
• Impact: Lack of effective safeguards against excessive login attempts.
• Affected Versions: All versions of RouterOS and Cloud Hosted Router (CVE-2026-16347).

Recommendations:

Until a fix is available, MikroTik recommends the following mitigations:

• Use a strong VPN or additional protection layer if the API is exposed to public networks.
• Configure unsuccessful-attempt time range (0.1 to 0.5 seconds) in /ip service for all services, including the API.
• Connect initially from a trusted network (LAN) port only.
• Restrict access to management services from untrusted networks.
• Apply firewall rules to control access.
• Use long, randomly generated passwords.

CISA urges users to minimize network exposure for all control system devices and perform proper impact analysis and risk assessment prior to deploying defensive measures. Organizations observing suspected malicious activity should report findings to CISA.

For more details, read the full advisory here: Read full article