CISA KEV Catalog Adds Five Exploited Flaws

Executive Summary

On September 12, 2026, the U.S. CISA added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing binding operational directives for federal agencies to apply patches within specified deadlines. These flaws impact widely used enterprise products from JFrog, ConnectWise, and MikroTik, and present a high risk of compromise. The vulnerabilities include an 8.1 CVSS flaw in JFrog Artifactory (CVE-2026-42016), a 9.9 CVSS flaw in ConnectWise ScreenConnect (CVE-2026-84869), and an 8.8 CVSS flaw in MikroTik RouterOS (CVE-2026-67277), among others. The short remediation deadlines (as early as September 13) underscore the critical threat these vulnerabilities pose. CISA strongly advises all organizations, not just federal agencies, to prioritize patching these flaws to prevent potential exploitation.

Vulnerabilities Addressed

This CISA directive covers five distinct vulnerabilities across three different vendors:

1. JFrog Artifactory Incorrect Authorization (CVE-2026-42016): This flaw, with a CVSS score of 8.1, can be chained with another vulnerability (CVE-2026-82329) to gain administrative control over self-hosted Artifactory servers. Attackers are known to be deploying backdoors after successful exploitation.

   • CVE-2026-82329: A critical flaw (CVSS 9.8) also affecting Artifactory, used in the exploit chain.
   • Patch Deadline: September 25, 2026.

2. ConnectWise ScreenConnect Improper Access Control (CVE-2026-84869): A critical vulnerability with a CVSS score of 9.9. It allows an attacker to transfer files and execute code through an active remote session without proper authorization, effectively hijacking a legitimate remote support session.

   • Patch Deadline: September 14, 2026.

3. MikroTik RouterOS Insufficient Validation (CVE-2026-67277 & CVE-2026-86060): These two vulnerabilities are being chained in an exploit named "MikroTrick." CVE-2026-67277 has a CVSS score of 8.8. The chain allows a remote, unauthenticated attacker to gain full administrative control of a vulnerable MikroTik device.

   • Patch Deadline: September 13, 2026.

Affected Products

• JFrog Artifactory: Self-hosted instances are at risk. The specific affected versions were not detailed in the CISA alert but users should consult JFrog's security advisories.
• ConnectWise ScreenConnect: All versions prior to the patched release are affected.
• MikroTik RouterOS: Various versions of the router operating system are vulnerable. CERT Polska has released detailed information on the "MikroTrick" exploit.

Impact Assessment

Exploitation of these vulnerabilities can lead to severe consequences:

• Full System Takeover: The flaws in Artifactory and RouterOS allow for complete administrative control, enabling attackers to install persistent backdoors, exfiltrate data, and pivot deeper into the network.
• Supply Chain Risk (Artifactory): Compromising an Artifactory server poses a grave supply chain risk, as attackers could poison software artifacts and distribute malicious code to downstream development projects and customers.
• Remote Access Hijacking (ScreenConnect): The ScreenConnect flaw allows attackers to abuse a trusted remote access tool, bypassing security controls to execute commands and steal data from managed endpoints.
• Network Infrastructure Compromise (RouterOS): Gaining control of MikroTik routers allows attackers to monitor, redirect, or block network traffic, conduct man-in-the-middle attacks, and use the devices as a platform for launching further attacks.

Deployment Priority

CISA's directive mandates a rapid patching timeline for federal agencies, which should serve as a guide for all organizations:

1. Critical (Patch Immediately): The MikroTik (CVE-2026-67277, CVE-2026-86060) and ConnectWise (CVE-2026-84869) vulnerabilities have deadlines of September 13 and 14, respectively. This indicates an extremely high risk of imminent, widespread exploitation. All internet-facing instances of these products should be patched or taken offline immediately.
2. High (Patch within 2 weeks): The JFrog Artifactory flaws (CVE-2026-42016, CVE-2026-82329) have a deadline of September 25. While the timeline is slightly longer, these should also be treated as a high priority, especially given the supply chain implications.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Remediation Steps

1. Identify Affected Assets: Use asset inventory systems and vulnerability scanners to identify all instances of JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS in your environment.
2. Apply Patches: Download and apply the security updates provided by each vendor immediately. Prioritize internet-facing systems.
3. Hunt for Compromise: After patching, review logs for any signs of exploitation that may have occurred prior to remediation. For Artifactory and RouterOS, a full compromise may have occurred, so look for backdoors, new user accounts, or unusual outbound traffic.
4. Implement Compensating Controls: If patching is not immediately possible, restrict access to the management interfaces of these products to trusted IP addresses only. For RouterOS, ensure the management interface is not exposed to the internet.