Your MikroTik Router Is a Brute-Force Target, and There's No Patch — Yet
CVE-2026-16347 (CVSS 8.8) hits every version of RouterOS: the API auth path has no real rate-limiting, lockout, or source restriction, so admin credentials can be hammered at high volume. CISA published ICSA-26-209-05 with a mitigation checklist that is the whole post.
High severity, 3 of 4. Patch at your next window. Real impact, real exposure.CVE-2026-16347
mikrotikrouterosbrute-force