CISA Adds 5 Exploited Flaws to KEV Catalog

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog to include five vulnerabilities that are being actively exploited in the wild. These flaws affect widely used enterprise products: JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. The vulnerabilities range in severity and impact, from privilege escalation and data leakage to near-critical remote code execution. By adding these to the KEV catalog, CISA is signaling a significant, ongoing threat and has mandated that Federal Civilian Executive Branch (FCEB) agencies apply patches by specified deadlines. Private organizations are also strongly encouraged to prioritize remediation of these vulnerabilities to defend against active attacks.

Vulnerability Details

The five vulnerabilities added to the KEV catalog are:

1. CVE-2026-42016 - JFrog Artifactory Incorrect Authorization

   • CVSS Score: 8.1 (High)
   • Impact: Allows for privilege escalation.
   • Patch Deadline (FCEB): September 25, 2026

2. CVE-2026-42018 - JFrog Artifactory Improper Authentication

   • CVSS Score: 7.5 (High)
   • Impact: Can lead to the leakage of sensitive data, even when anonymous access is configured to be disabled.
   • Patch Deadline (FCEB): September 25, 2026

3. CVE-2026-84869 - ConnectWise ScreenConnect Improper Privilege Management

   • CVSS Score: 9.9 (Critical)
   • Impact: Allows an attacker to execute file transfers and arbitrary code through an active remote session without proper authorization.
   • Patch Deadline (FCEB): September 14, 2026

4. CVE-2026-67277 - MikroTik RouterOS Missing Authentication

   • CVSS Score: 8.8 (High)
   • Impact: Can cause kernel memory disclosure. Part of an exploit chain known as "MikroTrick".
   • Patch Deadline (FCEB): September 13, 2026

5. CVE-2026-86060 - MikroTik RouterOS Privilege Escalation

   • CVSS Score: 9.2 (Critical)
   • Impact: Allows an attacker to achieve privilege escalation. Used in conjunction with CVE-2026-67277.
   • Patch Deadline (FCEB): September 13, 2026

Affected Systems

• JFrog Artifactory: Versions affected by CVE-2026-42016 and CVE-2026-42018. Administrators should consult JFrog security advisories for specific version information.
• ConnectWise ScreenConnect: Versions affected by CVE-2026-84869. Consult ConnectWise advisories for patched versions.
• MikroTik RouterOS: Versions affected by CVE-2026-67277 and CVE-2026-86060. These flaws are known to be chained together in attacks.

Exploitation Status

All five vulnerabilities are confirmed by CISA to be under active exploitation. The inclusion in the KEV catalog is based on reliable evidence that threat actors are using these flaws in real-world attacks. The "MikroTrick" exploit chain targeting MikroTik devices has been detailed by CERT Polska, indicating coordinated campaigns against these network devices. The short patching deadlines imposed by CISA underscore the urgency and active threat posed by these vulnerabilities.

Impact Assessment

The impact varies by product:

• Artifactory: Exploitation could allow an attacker to escalate privileges within the Artifactory instance, potentially leading to supply chain attacks by poisoning artifacts, or exfiltrate sensitive data and credentials stored within the repository manager.
• ScreenConnect: The flaw allows an attacker to hijack an existing remote support session to execute code on the endpoint. This is particularly dangerous for Managed Service Providers (MSPs) who use ScreenConnect to manage customer systems, as a compromise could lead to downstream attacks on their clients.
• RouterOS: The exploit chain allows an attacker to disclose kernel memory and then escalate privileges, leading to a full compromise of the network device. This gives the attacker control over the victim's network traffic, enabling man-in-the-middle attacks, traffic interception, and a persistent foothold for lateral movement.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) such as IP addresses or file hashes were mentioned in the source articles.

Cyber Observables — Hunting Hints

Security teams can hunt for signs of exploitation using the following observables:

Detection & Response

• Vulnerability Scanning: Regularly scan internal and external assets for the presence of these vulnerabilities using an up-to-date vulnerability management solution. D3FEND's Network Traffic Analysis can help identify vulnerable services.
• Log Analysis: Centralize and analyze logs from Artifactory, ScreenConnect servers, and MikroTik routers. Create alerts for privilege escalation events, unauthorized access attempts, or unusual system commands. This aligns with D3FEND's Log Analysis.
• Endpoint/Network Monitoring: For ScreenConnect, monitor endpoint process activity. For MikroTik, monitor network traffic for signs of compromise, such as traffic being redirected or connections to suspicious external hosts.

Remediation Steps

1. Prioritize and Patch: The primary remediation is to apply the security updates provided by JFrog, ConnectWise, and MikroTik immediately. Prioritize based on the CISA deadlines and the exposure of the systems. This is an application of D3FEND's Software Update.
2. Asset Inventory: Ensure you have a complete and accurate inventory of all Artifactory, ScreenConnect, and MikroTik assets in your environment to ensure all vulnerable instances are identified and patched.
3. Network Segmentation: For critical systems like Artifactory and ScreenConnect servers, ensure they are properly segmented from the broader network. Restrict access to only authorized users and systems. This is a form of D3FEND's Network Isolation.