CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

On September 10 and 11, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. They affect three products found in many enterprise networks: the JFrog Artifactory artifact repository, the ConnectWise ScreenConnect remote support tool and MikroTik’s router operating system, RouterOS. Each one sits at a high-value point in the infrastructure: the software supply chain, remote access to endpoints and the network edge. Patches are available for all three. The job now is to apply them and confirm that nothing was compromised before the patch went in.

The five vulnerabilities

CISA only adds a flaw to KEV when it has evidence of active exploitation. U.S. federal civilian agencies must then remediate by a set deadline. For everyone else, the catalog is one of the most reliable prioritization signals available.

JFrog Artifactory: from anonymous token to admin account

Neither flaw grants admin access by itself, but chained together they do. CVE-2026-42018 lets an unauthenticated caller obtain a JWT for the internal anonymous user, even when anonymous access is disabled. CVE-2026-42016 exists because Artifactory checks a token’s signature and issuer but not its scope, so that low-privileged token can be exchanged for an admin-scoped one.

Wiz observed multiple actors chaining the two flaws against self-hosted instances between August 15 and September 8, 2026. In some cases, an admin account was created less than five minutes after the first request. After gaining access, attackers created persistent admin accounts, installed malicious Groovy plugins to run commands and dropped a custom Rust backdoor with command-and-control capabilities. A third flaw, CVE-2026-82329, added to KEV on September 2, was also exploited. We cover that campaign in a separate article.

ConnectWise ScreenConnect: files executed without host approval

According to ConnectWise, a condition in the ScreenConnect client may, in certain circumstances, allow files to be transferred and executed through an active remote session without authorization or host confirmation. Clients before version 26.6.5 are affected. The vendor says servers are not. On September 3, before a fix was available, ConnectWise advised removing the TransferFiles permission (TransferFilesInSession on legacy versions) from every role.

Huntress described incidents in which rogue ScreenConnect instances, installed after social engineering, repeatedly launched wscript.exe to run four scripts (1.vbs to 4.vbs). The attackers persisted through a registry Run key named WindowsServiceHost. The modified clients pushed the VBScript chain to newly connected endpoints. Observed payloads covered discovery, persistence, extra ScreenConnect installs, tunneling, security-control changes and cryptocurrency mining. Huntress believes CVE-2026-84869 is the flaw being used. ConnectWise initially had not confirmed that link.

MikroTik RouterOS: exposed SSH on the front line

On September 5, 2026, CERT Polska published six RouterOS vulnerabilities found by its own researchers. Two of them are now in KEV:

• CVE-2026-67277: the btest service accepts a “related” connection before the primary session has authenticated. An unauthenticated client can start a UDP test that returns uninitialized data from a kernel packet buffer. A separate calculation bug can make the kernel restart.
• CVE-2026-86060: argument injection in the SSH login path, using usernames that start with a prohibited character, lets an attacker change the trusted policy mask and escalate privileges.

According to Hexnode, CERT Polska documented a takeover chain called “MikroTrick” that pairs CVE-2026-86060 with CVE-2026-67276 (an SSH RSA key authentication bypass) to gain unauthenticated admin control of devices with SSH exposed. MikroTik shipped fixes on September 3.

Why it matters for your organization

These three products have one thing in common: they sit where an attacker gains the most. A compromised Artifactory instance distributes build and deployment artifacts across the company, which is a direct software supply chain risk. An RMM tool like ScreenConnect is designed to run code on endpoints. A router under attacker control can observe and redirect traffic.

Timing is the other problem. In all three cases, exploitation started before or right after the fix was published. A monthly patch cycle is not enough for this kind of exposed asset. And because attackers created persistent accounts, plugins or registry keys, a patched instance can still be compromised.

MITRE ATT&CK view

The sources do not provide an ATT&CK mapping. The table below is an indicative Defensy reading of the behaviors described by Wiz, Huntress and CERT Polska.

Recommendations

1. ImmediateInventory and patch all three products

   List every self-hosted Artifactory instance, ScreenConnect server and client, and MikroTik device, including at subsidiaries and service providers. Apply the fixed versions above, starting with internet-facing assets.

2. ImmediateRemove unnecessary exposure

   Block SSH and RouterOS management interfaces from untrusted networks, disable the btest service if unused, and restrict Artifactory access to trusted networks and systems.

3. ImmediateScreenConnect: full patch or workaround

   Upgrade to 26.6.5, reinstall Host clients and update Access agents. If that is not possible, remove the TransferFiles permission from all roles, as ConnectWise advised.

4. Short termHunt for earlier compromise

   Artifactory: unknown admin accounts, long-lived tokens, unexpected Groovy plugins, files in /tmp, /dev/shm or /var/tmp. ScreenConnect: RunFiles or RanFiles entries in audit logs, wscript.exe spawned by the client, a “WindowsServiceHost” Run key. RouterOS: unknown users, scripts and configuration changes. Reimage any compromised endpoint from known-good media.

5. Short termRotate exposed secrets

   On a compromised Artifactory, reset the Access token signing certificate and rotate LDAP, proxy and remote repository credentials and the cluster join key. An upgrade does not revoke a key that has already been stolen.

6. Medium termBuild KEV into vulnerability management

   Subscribe to KEV updates and set a short internal patch deadline for any listed CVE that affects an exposed asset. Bring RMM tools and edge devices under continuous SOC monitoring.