The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added five new vulnerabilities—found in JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS—to its Known Exploited Vulnerabilities (KEV) catalog in response to confirmed active exploits. Organizations are urged to take immediate action.
Which Flaws Are Affected & What the Risks Are
Here are the five critical vulnerabilities that CISA added:
- CVE-2026-42016 (CVSS 8.1): an improper authorization bug in Artifactory that fails to check token scope, allowing possible privilege escalation.
- CVE-2026-42018 (CVSS 7.5): a flawed authentication flow in Artifactory that may disclose an anonymous-user token even when anonymous access is supposed to be disabled.
- CVE-2026-84869 (CVSS 9.9): a missing privilege management and authorization bug in ScreenConnect which could allow unauthorized file transfers and remote execution during active sessions.
- CVE-2026-67277 (CVSS 8.8): in RouterOS, a missing authentication issue in the btest service that could expose kernel memory or enable denial-of-service.
- CVE-2026-86060 (CVSS 9.2): a bug that lets attackers modify important policy masks in RouterOS by abusing argument delimiters, leading to privilege escalation.
What’s Happened in the Wild
Recent incidents show the Artifactory vulnerabilities being chained with CVE-2026-82329 to seize control over self-hosted servers, deploy backdoors, and install malicious plugins. These were observed between August 15 and September 8, 2026.
Meanwhile, the ScreenConnect flaw CVE-2026-84869 has been used in at least three unrelated incidents where attackers delivered malicious Visual Basic Script payloads through remote sessions. The issue resides in the client software, not the server side, and can allow elevated execution on host systems under certain conditions. ScreenConnect’s version 26.6.5 contains the fix.
The RouterOS bugs (CVE-2026-67277 and CVE-2026-86060) were flagged by CERT Polska, which observed threat actors using them—dubbed the MikroTrick attack chain—to gain control over RouterOS devices without authentication.
Patching Deadlines & Who’s Impacted
Federal Civilian Executive Branch agencies must comply with these patching deadlines:
- RouterOS flaws by September 13, 2026
- ScreenConnect issue by September 14, 2026
- Artifactory vulnerabilities by September 25, 2026
Given the high scores—some near the maximum—and the proof that attackers are exploiting these in real environments, organizations running any of these systems should treat them like emergencies.
This update highlights the escalating tactic of chaining vulnerabilities to magnify impact. The timing underscores how critical it is for teams to close gaps not only as patches become available, but before attackers can turn proof-of-concepts into full exploits.
Take-Away for Security Teams
If your environment uses JFrog Artifactory, ScreenConnect clients, or MikroTik RouterOS, prioritize patching immediately. Run vulnerability scans, verify versions, and if possible, disable vulnerable services until patched. Also review your remote access and remote session policies—in many cases poor configuration or delayed updates are what turn a bug into a breach.
This isn’t just about specific vendors—it reflects a trend: threat actors are increasingly combining vulnerabilities across products to breach systems. Defending against this requires tighter change management, faster vulnerability triage, and cross-product visibility.
