CISA KEV Catalog Adds Five Exploited Flaws
CISA adds five actively exploited flaws to its KEV catalog
Related Entities
Organizations
Products & Tech
CVE Identifiers
Full Report
Executive Summary
On September 12, 2026, the U.S. CISA added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing binding operational directives for federal agencies to apply patches within specified deadlines. These flaws impact widely used enterprise products from JFrog, ConnectWise, and MikroTik, and present a high risk of compromise. The vulnerabilities include an 8.1 CVSS flaw in JFrog Artifactory (CVE-2026-42016), a 9.9 CVSS flaw in ConnectWise ScreenConnect (CVE-2026-84869), and an 8.8 CVSS flaw in MikroTik RouterOS (CVE-2026-67277), among others. The short remediation deadlines (as early as September 13) underscore the critical threat these vulnerabilities pose. CISA strongly advises all organizations, not just federal agencies, to prioritize patching these flaws to prevent potential exploitation.
Vulnerabilities Addressed
This CISA directive covers five distinct vulnerabilities across three different vendors:
JFrog Artifactory Incorrect Authorization (
CVE-2026-42016): This flaw, with a CVSS score of 8.1, can be chained with another vulnerability (CVE-2026-82329) to gain administrative control over self-hosted Artifactory servers. Attackers are known to be deploying backdoors after successful exploitation.CVE-2026-82329: A critical flaw (CVSS 9.8) also affecting Artifactory, used in the exploit chain.- Patch Deadline: September 25, 2026.
ConnectWise ScreenConnect Improper Access Control (
CVE-2026-84869): A critical vulnerability with a CVSS score of 9.9. It allows an attacker to transfer files and execute code through an active remote session without proper authorization, effectively hijacking a legitimate remote support session.- Patch Deadline: September 14, 2026.
MikroTik RouterOS Insufficient Validation (
CVE-2026-67277&CVE-2026-86060): These two vulnerabilities are being chained in an exploit named "MikroTrick."CVE-2026-67277has a CVSS score of 8.8. The chain allows a remote, unauthenticated attacker to gain full administrative control of a vulnerable MikroTik device.- Patch Deadline: September 13, 2026.
Affected Products
- JFrog Artifactory: Self-hosted instances are at risk. The specific affected versions were not detailed in the CISA alert but users should consult JFrog's security advisories.
- ConnectWise ScreenConnect: All versions prior to the patched release are affected.
- MikroTik RouterOS: Various versions of the router operating system are vulnerable. CERT Polska has released detailed information on the "MikroTrick" exploit.
Impact Assessment
Exploitation of these vulnerabilities can lead to severe consequences:
- Full System Takeover: The flaws in Artifactory and RouterOS allow for complete administrative control, enabling attackers to install persistent backdoors, exfiltrate data, and pivot deeper into the network.
- Supply Chain Risk (Artifactory): Compromising an Artifactory server poses a grave supply chain risk, as attackers could poison software artifacts and distribute malicious code to downstream development projects and customers.
- Remote Access Hijacking (ScreenConnect): The ScreenConnect flaw allows attackers to abuse a trusted remote access tool, bypassing security controls to execute commands and steal data from managed endpoints.
- Network Infrastructure Compromise (RouterOS): Gaining control of MikroTik routers allows attackers to monitor, redirect, or block network traffic, conduct man-in-the-middle attacks, and use the devices as a platform for launching further attacks.
Deployment Priority
CISA's directive mandates a rapid patching timeline for federal agencies, which should serve as a guide for all organizations:
- Critical (Patch Immediately): The MikroTik (
CVE-2026-67277,CVE-2026-86060) and ConnectWise (CVE-2026-84869) vulnerabilities have deadlines of September 13 and 14, respectively. This indicates an extremely high risk of imminent, widespread exploitation. All internet-facing instances of these products should be patched or taken offline immediately. - High (Patch within 2 weeks): The JFrog Artifactory flaws (
CVE-2026-42016,CVE-2026-82329) have a deadline of September 25. While the timeline is slightly longer, these should also be treated as a high priority, especially given the supply chain implications.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
url_pattern/api/access/process_nameScreenConnect.Client.exeScreenConnect.Client.exe executing unusual commands or spawning child processes not initiated by a legitimate technician.network_traffic_patternlog_sourceArtifactory service logsRemediation Steps
- Identify Affected Assets: Use asset inventory systems and vulnerability scanners to identify all instances of JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS in your environment.
- Apply Patches: Download and apply the security updates provided by each vendor immediately. Prioritize internet-facing systems.
- Hunt for Compromise: After patching, review logs for any signs of exploitation that may have occurred prior to remediation. For Artifactory and RouterOS, a full compromise may have occurred, so look for backdoors, new user accounts, or unusual outbound traffic.
- Implement Compensating Controls: If patching is not immediately possible, restrict access to the management interfaces of these products to trusted IP addresses only. For RouterOS, ensure the management interface is not exposed to the internet.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
The primary mitigation is to apply the security updates provided by the respective vendors immediately.
Mapped D3FEND Techniques:
Restrict network access to the management interfaces of these applications to only authorized personnel and trusted IP ranges.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
Given that all five vulnerabilities are under active exploitation, applying vendor-supplied patches is the most critical and effective countermeasure. Organizations must use asset and patch management systems to immediately identify and update all instances of JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. The patching priority should align with CISA's deadlines: MikroTik and ConnectWise systems should be treated as an emergency, patched within 24 hours. For Artifactory, which has a significant supply chain risk profile, patching should also be expedited. Verifying successful patch application through vulnerability scanning is a crucial follow-up step to ensure the risk has been fully mitigated.
As a compensating control, especially if immediate patching is not feasible, organizations must implement strict network access controls for the management interfaces of these products. For internet-facing systems like MikroTik routers and ScreenConnect servers, create explicit firewall rules that only allow access from a small, well-defined set of trusted IP addresses (e.g., corporate VPN ranges, specific administrative subnets). Deny all other inbound traffic to these management ports by default. This technique of network isolation dramatically reduces the attack surface exposed to external attackers, preventing them from reaching the vulnerable services in the first place. This is a critical stop-gap measure to apply while the patching process is underway.
Timeline of Events
CISA adds five vulnerabilities affecting JFrog, ConnectWise, and MikroTik products to its KEV catalog.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.