CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
CISA added five actively exploited JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS flaws to its KEV catalog.
CISA added five actively exploited vulnerabilities to the KEV catalog: CVE-2026-42016 and CVE-2026-42018 in JFrog Artifactory, CVE-2026-84869 in ConnectWise ScreenConnect (CVSS 9.9), and CVE-2026-67277 and CVE-2026-86060 in MikroTik RouterOS. The Artifactory bugs are chained with CVE-2026-82329 to gain administrative control, deploy malicious Groovy plugins, and install Rust-based backdoors. CERT Polska dubbed the RouterOS chain 'MikroTrick'; FCEB agencies must patch between September 13 and 25, 2026.
- Five CVEs added to KEV: two Artifactory, one ScreenConnect, two RouterOS
- Artifactory flaws chained with CVE-2026-82329 for admin takeover and backdoor deployment
- ScreenConnect CVE-2026-84869 (CVSS 9.9) enables unauthorized file transfer and execution on hosts
- RouterOS exploit chain tracked as MikroTrick by CERT Polska
- FCEB patch deadlines: RouterOS Sept 13, ScreenConnect Sept 14, Artifactory Sept 25
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42016 | Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory | 8.8 | 9% | KEV | KEV |
| CVE-2026-42018 | Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens | 7.5 | 10% | KEV | KEV |
CVE-2026-86060+1 related CVE | Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation | 9.2 group max | 6% | KEVPoC ×3 | KEV |
| CVE-2026-82329 | Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access | 9.8 | 14% | KEVPoC ×2 | KEV |
| CVE-2026-84869 | Missing authorization in ScreenConnect client allows unauthorized file execution | 9.9 | <1% | KEV | KEV |
From the original article
2 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.