CISA Adds Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

Active exploitation targeting developer infrastructure, remote monitoring software, and network routing hardware has prompted the Cybersecurity and Infrastructure Security Agency (CISA) to add five security flaws to its Known Exploited Vulnerabilities (KEV) catalog. The newly cataloged bugs impact self-hosted JFrog Artifactory artifact repositories, ConnectWise ScreenConnect client software, and MikroTik RouterOS network devices. Threat actors are actively leveraging these weaknesses—often in multi-stage exploit chains—to bypass authentication, gain root or administrator access, execute arbitrary code, and establish persistent backdoors on compromised hosts.

The entries include two authorization and authentication flaws in JFrog Artifactory (CVE-2026-42016 and CVE-2026-42018), a critical remote execution flaw in ConnectWise ScreenConnect (CVE-2026-84869), and two router compromise vulnerabilities in MikroTik RouterOS (CVE-2026-67277 and CVE-2026-86060).

Chained Attacks Target Self-Hosted JFrog Artifactory

The two JFrog Artifactory vulnerabilities added to the catalog are being chained alongside CVE-2026-82329—a critical flaw added to the KEV catalog earlier this month—to compromise self-hosted enterprise repositories.

The first issue, tracked as CVE-2026-42016 (CVSS score 8.1), stems from an incorrect authorization flaw classified under CWE-863. The weakness occurs because Artifactory validates token signatures and issuers without properly validating the token’s scope. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) highlights that an attacker requires low-privileged network access and no user interaction to execute the exploit. While its measured Exploit Prediction Scoring System (EPSS) score sits at 0.89% (putting it in the 57th percentile of scored vulnerabilities), its inclusion in active threat actor campaigns makes it an immediate risk for enterprise environments.

The second Artifactory flaw, CVE-2026-42018 (CVSS score 7.5), involves improper authentication handling. When anonymous access is explicitly disabled on an Artifactory instance, the system can still return an internal anonymous-user token to an unauthenticated caller, exposing sensitive internal resources and configuration data.

Security telemetry from Wiz confirms that attackers systematically chained these two vulnerabilities with CVE-2026-82329 between August 15 and September 8, 2026. Once initial authentication bypass and privilege escalation are achieved on self-hosted servers, threat actors execute a distinct post-exploitation playbook:

1. Creating persistent administrator accounts to maintain access.
2. Uploading malicious Groovy plugins to execute arbitrary server-side code.
3. Deploying custom Rust-based backdoors to secure long-term persistence within the target network.

Organizations running self-hosted JFrog Artifactory versions prior to 7.133.11 are vulnerable to this exploit chain.

ScreenConnect Client Flaw Used for VBScript Payload Delivery

A severe vulnerability in ConnectWise ScreenConnect, designated CVE-2026-84869 (CVSS score 9.9), has also entered the KEV list following confirmed operational abuse. The flaw is caused by improper privilege management and missing authorization within the ScreenConnect client application.

Under specific conditions, an attacker can initiate unauthorized file transfers and execute payloads through an active remote session without requiring authorization or confirmation from the host. ConnectWise clarified that the flaw resides specifically in the ScreenConnect client condition and does not affect ScreenConnect server instances directly.

Analysis from Huntress tied the exploitation of CVE-2026-84869 to at least three distinct intrusion incidents. In these attacks, threat actors leveraged active remote sessions to deploy a malicious Visual Basic Script (VBScript) payload onto host client systems, facilitating secondary payload execution under elevated client privileges.

MikroTik RouterOS Vulnerabilities Exploited via “MikroTrick”

Edge networking devices running MikroTik RouterOS face active targeted attacks exploiting two distinct system vulnerabilities.

• CVE-2026-67277 (CVSS score 8.8): A missing authentication mechanism for a critical function within the RouterOS btest (bandwidth test) service. Unauthenticated remote attackers can trigger kernel memory disclosure and cause denial-of-service conditions.
• CVE-2026-86060 (CVSS score 9.2): An improper neutralization of argument delimiters in command handling. Attackers can exploit this injection flaw to alter the trusted RouterOS policy mask, elevating privileges to administrator level.

CERT Polska identified real-world intrusion activity where unknown threat actors chained these two bugs in an attack flow dubbed “MikroTrick.” By pairing the authentication bypass with policy mask manipulation, attackers obtain full, unauthenticated control of vulnerable MikroTik hardware.

Immediate Patching and Remediation Guidance

Federal Civilian Executive Branch (FCEB) agencies operating under Binding Operational Directive (BOD) 22-01 are mandated to apply vendor updates according to strict timelines: MikroTik RouterOS fixes must be applied by September 13, 2026; ConnectWise ScreenConnect by September 14, 2026; and JFrog Artifactory by September 25, 2026. Private sector organizations should mirror these remediation windows given the documented active exploitation.

System administrators should immediately execute the following remediations:

• JFrog Artifactory: Upgrade all self-hosted deployment instances to version 7.133.11 or later. In addition to patching, security teams should inspect server environments for anomalous Groovy plugins created after August 15, 2026, audit local user accounts for unexpected administrator accounts, and scan for unauthorized Rust binaries running in server background processes.
• ConnectWise ScreenConnect: Ensure all endpoint clients are updated to ScreenConnect version 26.6.5 or higher to prevent unauthorized payload transfers across established remote sessions.
• MikroTik RouterOS: Upgrade RouterOS device firmware to the latest stable release provided by MikroTik. Where immediate updates are impossible, disable the btest service on external interfaces and restrict access to management services using IP access lists.