CISA Adds Exploited JFrog, ScreenConnect, RouterOS Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The newly listed flaws affect JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS, and they come after reports of attackers using them in real-world attacks. The KEV catalog is a public list of security weaknesses that U.S. federal agencies and many private organizations use to prioritize patching because there is confirmed evidence of active exploitation.

Two of the vulnerabilities affect JFrog Artifactory, a widely used software repository manager that many development teams run on their own servers to store and distribute code packages. CVE-2026-42016 has a CVSS score of 8.1 and is an incorrect authorization flaw. A token is a digital credential that proves who someone is and what they are allowed to do. This flaw means the system checks who issued the token but not what the token is allowed to do, so an attacker can gain higher permissions than intended, a situation known as privilege escalation. CVE-2026-42018 has a CVSS score of 7.5 and is an improper authentication flaw. When anonymous access is disabled, the software can still return an internal anonymous-user token to an unauthenticated caller, potentially exposing sensitive resources.

Earlier reporting by The Hacker News and Google-owned security vendor Wiz showed that attackers chained these two Artifactory weaknesses together with CVE-2026-82329, a critical flaw with a CVSS score of 9.8 that CISA had already added to the KEV catalog earlier this month. Between August 15 and September 8, 2026, the attackers used the chain to bypass authentication, escalate privileges, and take administrator control of self-hosted Artifactory servers. Wiz said that post-exploitation activity included creating persistent administrator accounts, deploying malicious Groovy plugins for code execution, and installing Rust-based backdoors to maintain long-term access. This shows that the flaws are not theoretical, attackers are actively using them to compromise real servers.

The third newly listed flaw is CVE-2026-84869, a high severity issue in ConnectWise ScreenConnect with a CVSS score of 9.9. ScreenConnect is a remote access and support tool that lets technicians connect to and control computers. The flaw is described as improper privilege management and missing authorization. ConnectWise said the issue is a condition in the ScreenConnect client that may allow files to be transferred and executed through an active remote session without authorization or host confirmation in certain circumstances. This means an attacker who already has an active remote session could push a file onto the machine and run it without the person at the other end approving the action. The vendor said the flaw does not affect ScreenConnect servers. Huntress documented three separate incidents in which threat actors abused the ScreenConnect flaw to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. Huntress urged organizations to update to ScreenConnect version 26.6.5.

The final two vulnerabilities affect MikroTik RouterOS, the operating system used on MikroTik routers and other network devices. CVE-2026-67277 has a CVSS score of 8.8 and is a missing authentication for a critical function. It can allow kernel memory disclosure and denial-of-service in the btest service. CVE-2026-86060 has a CVSS score of 9.2 and is an improper neutralization of argument delimiters in a command. It can allow an attacker to change the trusted RouterOS policy mask and achieve privilege escalation. The policy mask controls which users or roles are trusted on a RouterOS device, so changing it can give an attacker higher control. CISA added these two flaws after CERT Polska reported last week that unknown threat actors were exploiting two RouterOS weaknesses to take control of vulnerable devices without authentication. CERT Polska named the exploit chain MikroTrick. Federal Civilian Executive Branch (FCEB) agencies are required to patch the RouterOS flaws by September 13, 2026, the ScreenConnect flaw by September 14, 2026, and the Artifactory flaws by September 25, 2026.

For website owners, businesses, and IT teams, this catalog update is a practical warning. Self-hosted software like Artifactory can sit between development tools and production websites, so a compromise can give attackers a path to code and data. Remote access tools such as ScreenConnect are valuable to attackers because they provide a legitimate way into a system once credentials or a session are abused. RouterOS devices are often the first network hop for a small business or remote office, making them a high-value target for attackers who want to intercept traffic or move deeper into a network. Because the KEV catalog only lists vulnerabilities with confirmed active exploitation, seeing these five entries means that patching should be treated as urgent rather than routine. For organizations that run self-hosted applications or manage remote access tools, AEU-I provides security-first IT, infrastructure and consulting that can help teams track vulnerabilities and apply patches before they cause damage. Reviewing the service details at aeu-i.com is a good first step for readers who need outside help with patch management.