CVE-2026-16347 describes a rate-limiting bypass in MikroTik RouterOS that exploits the difference between per-connection delays and actual session-based throttling. The vulnerability isn't that MikroTik lacks authentication rate-limiting—it's that the existing defense was designed around a sequential, single-connection attacker model. By opening multiple concurrent API sessions, an attacker can parallelize authentication attempts indefinitely, rendering the per-connection delay meaningless. This is architecturally distinct from a broken rate-limiter; it's a defense built on an incorrect mental model of the attack surface.
The phrase 'some versions' in the CVE description is your most important operational detail. It indicates the bypass has been acknowledged internally but the fix has not been consistently applied across the RouterOS version ecosystem. Checking whether your device 'has delay' does not equal checking whether it 'is patched'—these may be entirely different states depending on your specific version and branch. The patch history suggests MikroTik addressed the symptom (adding or strengthening the delay) rather than redesigning the underlying architecture, which raises questions about long-term resilience against variant attacks.
For defenders: prioritize identifying your exact RouterOS version and cross-reference it against any official MikroTik security advisories for this CVE. If you're running an older stable release, verify that the fix has actually been backported—don't assume 'RouterOS' equals 'protected.' The CVSS 8.8 score reflects the potential severity (administrator access via credential compromise), but the exploit requires concurrent session manipulation that imposes some practical barriers. However, those barriers disappear for targeted attacks against high-value MikroTik deployments, particularly given these devices' common role as ISP edge routers, VPN concentrators, and small-business gateways. A successful exploit doesn't give you one device—it gives you a network pivot with traffic interception and lateral movement potential that far exceeds the CVE's direct scope.
Assume this vulnerability class will recur. The pattern of rate-limiting designed around sequential connections has appeared across multiple embedded networking vendors, suggesting the underlying architectural culture in embedded firmware development hasn't been systematically corrected. Monitor for follow-on CVEs addressing the same root cause.