The Box You Forgot About: A Password-Guessing Flaw Turns MikroTik Routers Into Open Doors
The router sitting in your office closet may be the least monitored device on your network — and right now, it may also be the most exposed. CISA is warning that every version of MikroTik's RouterOS and Cloud Hosted Router carries a flaw (CVE-2026-16347, scored 8.8 out of 10) that lets attackers rapidly guess passwords until one works. No exotic hacking required — just patience the router won't interrupt.
Bottom Line
This isn't a sophisticated nation-state exploit — it's a missing seatbelt on a device millions of organizations trust as their front door. The flaw affects all versions, the attack method is trivially automated, and history shows MikroTik routers are prime botnet material. The gap between how critical routers are and how little attention they get is the real vulnerability here.