CISA has added five actively exploited vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog. For security teams, this is not a routine patch notice: KEV additions mean exploitation has been observed in the wild, and these products often sit in high-trust positions inside enterprise environments.

The affected technologies are especially attractive to attackers. Artifactory commonly stores build artifacts, packages, and software supply chain assets. ScreenConnect is a remote access tool that can touch many endpoints quickly. RouterOS powers edge networking devices that are often exposed, difficult to monitor, and valuable for persistence or traffic interception. Organizations using any of these products should treat this update as an urgent exposure-management and incident-response trigger, not just a ticket for the next maintenance window.

What CISA Added to KEV

The five vulnerabilities are:

- CVE-2026-42016: an incorrect authorization issue in JFrog Artifactory that can enable privilege escalation when token validation checks the signature or issuer but not the token scope.
- CVE-2026-42018: an improper authentication issue in JFrog Artifactory that can expose an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled, creating a path to sensitive resources.
- CVE-2026-84869: a ConnectWise ScreenConnect client issue that can allow file transfer and execution through an active remote session without proper authorization or host confirmation under certain conditions.
- CVE-2026-67277: a MikroTik RouterOS btest service flaw involving missing authentication for a critical function, with potential kernel memory disclosure and denial-of-service impact.
- CVE-2026-86060: a MikroTik RouterOS command argument-delimiter flaw that can allow manipulation of the trusted policy mask and privilege escalation.

CISA’s federal deadlines are tight: the RouterOS flaws are due first, followed by ScreenConnect, while the Artifactory issues carry a later September 25 deadline. Private-sector organizations are not bound by those federal mandates, but KEV deadlines are still useful prioritization signals. If the software is internet-facing, used by administrators, or connected to production software delivery workflows, waiting increases risk.

Why These Bugs Matter Operationally

The Artifactory issues are particularly concerning because they may be chained with other weaknesses to bypass authentication and gain administrative control over self-hosted instances. Once an attacker controls an artifact repository, the blast radius can extend beyond the server itself. Malicious packages, modified build dependencies, stolen credentials, and tampered plugins can all become part of a broader supply chain intrusion.

Reported post-exploitation behavior around Artifactory has included creation of persistent administrator accounts, deployment of malicious Groovy plugins for code execution, and installation of Rust-based backdoors. That means defenders should not assume that applying a patch fully closes the incident. If an exposed Artifactory instance was vulnerable during the observed exploitation window, teams should review administrative users, plugins, access tokens, outbound connections, and artifact integrity.

ScreenConnect risk is different but equally practical. Remote access software is designed to move files, execute commands, and support endpoints. A flaw that allows unauthorized file transfer or execution through an active remote session can turn legitimate support infrastructure into a delivery mechanism for malware. Hunt activity should focus on unusual script execution, unexpected file transfers, suspicious VBScript payloads, anomalous remote sessions, and newly connected systems that received files shortly after connection.

RouterOS vulnerabilities deserve special attention because network appliances are often under-instrumented. Compromised routers can provide attackers with stealthy access, traffic visibility, pivot points, or disruption capability. The reported RouterOS chain, dubbed MikroTrick by researchers, involved unauthenticated takeover of vulnerable devices. Asset owners should assume that exposed RouterOS management or services are high-priority targets and should verify both version status and configuration hardening.

Recommended Response Plan

Start with asset identification. Confirm whether your organization runs self-hosted JFrog Artifactory, ConnectWise ScreenConnect clients, or MikroTik RouterOS devices. Do not rely only on CMDB records; check external attack-surface inventories, endpoint management data, software deployment records, and network scans.

Next, patch or upgrade using vendor-supported versions. ConnectWise has urged organizations to update ScreenConnect to version 26.6.5. For Artifactory and RouterOS, follow the relevant vendor security advisories and verify that fixes are actually applied across production, staging, disaster recovery, and forgotten edge systems.

Then look for evidence of compromise. For Artifactory, review user and token activity, administrator account creation, plugin changes, Groovy execution, suspicious repository access, and unexpected outbound connections. Rotate credentials that may have been exposed through repository access, including CI/CD tokens, package registry secrets, and cloud deployment keys. For ScreenConnect, review session logs, file transfers, execution events, and payloads delivered to hosts. For RouterOS, inspect configuration changes, unexpected users, policy mask changes, exposed services, firewall rules, scheduled tasks, and unexplained reboots or crashes.

Finally, reduce future exposure. Remove direct internet access where possible, enforce multifactor authentication for administrative consoles, restrict management interfaces to VPN or trusted networks, and centralize logs from build systems, remote management tools, and routers. KEV entries are a reminder that attackers move quickly once public or semi-public exploit knowledge exists; resilient organizations combine rapid patching with detection and containment.

Bottom Line

These five KEV additions cover three categories attackers love: software supply chain infrastructure, remote administration, and edge networking. If any affected product is present in your environment, prioritize remediation immediately and pair the update with a focused compromise assessment. The most important question is not only “Are we patched?” but also “Were we exposed while exploitation was active?”

Source: The Hacker News source