Search: “groovy”

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

CISA added five actively exploited JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS flaws to its KEV catalog.

CISA added five actively exploited vulnerabilities to the KEV catalog: CVE-2026-42016 and CVE-2026-42018 in JFrog Artifactory, CVE-2026-84869 in ConnectWise ScreenConnect (CVSS 9.9), and CVE-2026-67277 and CVE-2026-86060 in MikroTik RouterOS. The Artifactory bugs are chained with CVE-2026-82329 to gain administrative control, deploy malicious Groovy plugins, and install Rust-based backdoors. CERT Polska dubbed the RouterOS chain 'MikroTrick'; FCEB agencies must patch between September 13 and 25, 2026.

The Hacker News·updated Sep 14, 14:08 UTC · 1d ago·first Sep 12, 15:54 UTC · 3d agoExploit / PoC in the wild 2 sourcesCVE-2026-42016CVE-2026-42018CVE-2026-84869+3 CVEs2· 1 read

Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers chained JFrog Artifactory flaws CVE-2026-42018 and CVE-2026-42016 for admin control, planting Rust backdoors; CVE-2026-82329 also mass-exploited.

Wiz observed attackers chaining CVE-2026-42018 (anonymous-token leak) and CVE-2026-42016 (token escalation) in self-hosted JFrog Artifactory between August 15 and September 8, gaining admin control, creating admin accounts, and installing malicious Groovy plugins and a custom Rust backdoor. Separately, critical authentication bypass CVE-2026-82329 (CVSS 9.8) was mass-exploited starting September 1, drawing ~406,000 exploitation attempts on September 2 per Fastly. CISA added CVE-2026-82329 to KEV on September 2 with a September 5 federal deadline. Patching does not revoke minted tokens or rotate stolen join keys; admins must review accounts and rotate credentials.

The Hacker News·updated Sep 14, 09:27 UTC · 1d ago·first Sep 11, 07:31 UTC · 4d agoExploit / PoC in the wild 7 sourcesCVE-2026-42018CVE-2026-42016CVE-2026-823292

U.S. CISA adds XWiki Platform, and Broadcom VMware Aria Operations and VMware Tools flaws to its Known Exploited Vulnerabilities catalog

Security Affairs·Oct 30, 23:15 UTC · Oct 30, 2025Exploit / PoC in the wildCVE-2025-24893CVE-2025-41244

CISA Flags Critical Apache OFBiz Flaw Amid Active Exploitation Reports

The Hacker News·Aug 28, 06:50 UTC · Aug 28, 2024Exploit / PoC in the wildCVE-2024-38856CVE-2024-36104CVE-2024-32113

New PoC Exploit for Apache OfBiz Vulnerability Poses Risk to ERP Systems

The Hacker News·Jan 15, 00:00 UTC · Jan 15, 2024Exploit / PoC in the wildCVE-2023-51467CVE-2023-49070CVE-2020-9496+2 CVEs