VulnSocial

CVE-2026-16347Disclosure

MEDIUMCVSS 8.7 · HIGH

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-307

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 6 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 5 signals
  • Disclosure: 5 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-08-03)
  • 6 total mentions across 5 days

Deep dive

Activity timeline6 mentions / 5d
01122Mentions · 2026-07-28: 1Mentions · 2026-07-29: 1Mentions · 2026-08-01: 1Mentions · 2026-08-02: 1Mentions · 2026-08-03: 2Active Exploitation · 2026-07-28: 1Patch / Workaround · 2026-08-01: 1Patch / Workaround · 2026-08-02: 1Technical Details · 2026-07-29: 1Technical Details · 2026-08-01: 1Technical Details · 2026-08-02: 1Technical Details · 2026-08-03: 207-2807-2908-0108-0208-03
Signal classification2 categories
Disclosure
583.3%
Active Exploitation
116.7%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-07-281
Active Exploitation1
2026-07-291
Disclosure1
2026-08-011
Disclosure1
2026-08-021
Disclosure1
2026-08-032
Disclosure2
Full discourse6 posts
  • ZoomEye@zoomeye_team
    Disclosure

    🚨 CVE-2026-16347: Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router Critical Vulnerability Alert! MikroTik RouterOS is affected by CVE-2026-16347. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-16347 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-16347" Search Dork: app="MikroTik RouterOS" Exposure: 934.8k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJNaWtyb1RpayBSb3V0ZXJPUyI=&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260803 #Infosec #CyberSecurity #ZoomEye #DarkEye

    Post summary

    The tweet announces CVE-2026-16347 for MikroTik RouterOS, highlighting an authentication retry weakness and linking to a darkeye analysis, without mentioning any PoC, exploit, or patch.

    220148116.8K
    12.7K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Disclosure

    CVE-2026-16347 lets attackers brute-force MikroTik RouterOS logins for unauthorized system access. Rated CVSS 8.8, with no fix yet. Apply mitigations. #MikroTik #RouterOS #CVE202616347 #BruteForce #CISA #CyberSecurity http://securityonline.info/mikrotik-routeros-cve-2026-16347/

    Post summary

    CVE-2026-16347 is a brute‑force login vulnerability in MikroTik RouterOS rated CVSS 8.8 with no patch yet; mitigations are recommended.

    05031583
    13.0K followersView on X
  • kokumօtօ@__kokumoto
    Disclosure

    MikroTikのRouterOSに総当たり攻撃が可能となる未修正の脆弱性。CVE-2026-16347はCVSSスコア8.8で、API認証に流量制限、アカウントロック、ソースベースの制限のいずれも実装されていないものクラウド版Cloud Hosted Routerにも影響。緩和策はAPIアクセスをVPN越しに制限。 https://securityonline.info/mikrotik-routeros-cve-2026-16347/

    Post summary

    The article announces an unpatched vulnerability in MikroTik RouterOS (CVE‑2026‑16347) that permits brute‑force API attacks, scores 8.8 on CVSS, and provides a mitigation of restricting API access through VPN.

    010311.1K
    7.8K followersView on X
  • Netlas.io@Netlas_io
    Disclosure

    CVE-2026-16347: Possible brute-force attack in Mikrotik RouterOS, 8.8 rating ‍🔥 MikroTik RouterOS contains a weakness in its API authentication handling that allows attackers to brute-force logins for unauthorized system access. 👉 https://nt.ls/mMq91

    Post summary

    The message announces a CVE-2026-16347 vulnerability in Mikrotik RouterOS, describing a brute‑force login weakness and providing a link likely to further details.

    02011668
    7.6K followersView on X
  • Israel@f1tym1
    Disclosure

    CVE-2026-16347 in MikroTik RouterOS allows attackers to brute-force credentials, affecting critical infrastructure sectors globally. https://ift.tt/p01Ce24

    Post summary

    The post announces CVE‑2026‑16347, a brute‑force credential vulnerability in MikroTik RouterOS that could impact critical infrastructure, but offers no evidence of active exploitation, PoC, or remedial measures.

    0000034
    1.0K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploiting CVE-2026-16347 to brute-force MikroTik RouterOS credentials, then moving laterally across networks. This incident highlights how authentication weaknesses in network infrastructure can enable broad compromise. Runtime segmentation helps contain post-breach lateral movement. #ZeroTrust 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/mikrotik-routeros-cve-2026-16347

    Post summary

    The post reports that CVE-2026-16347 is actively being exploited via credential brute‑force on MikroTik RouterOS, underscoring authentication flaws, but it does not provide PoC, exploit code, or patch details.

    0000049
    1.9K followersView on X

Explore more

Back to dashboard