CISA Adds 5 Flaws in ScreenConnect, MikroTik & JFrog to KEV

The Cybersecurity and Infrastructure Security Agency (CISA) has added five newly confirmed zero-day and n-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The additions follow active in-the-wild exploitation campaigns targeting enterprise remote management software, critical network routing infrastructure, and software supply chain artifact repositories.

Pursuant to Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies and global security operations teams are required to apply vendor patches immediately under strict mitigation timelines to prevent persistent network compromise.

Technical Analysis

The five vulnerabilities span three major enterprise software platforms, targeting disparate operational layers:

ConnectWise ScreenConnect (CVE-2026-84869)

Carrying a near-maximum CVSS score of 9.9, this vulnerability represents an improper privilege management and authorization failure within the ScreenConnect client software. Under specific execution conditions during active remote support sessions, an attacker can transfer and execute arbitrary files on the host client system without requiring administrative authorization or host confirmation. Unlike previous ScreenConnect zero-days targeting cloud management consoles, this flaw specifically abuses client-side session handlers to achieve elevated code execution.

MikroTik RouterOS 'MikroTrick' Chain (CVE-2026-67277 & CVE-2026-86060)

Disclosed by CERT Polska as part of an unauthenticated remote intrusion campaign dubbed MikroTrick, threat actors chain two distinct flaws in MikroTik RouterOS to compromise edge networking equipment:

• CVE-2026-67277 (CVSS 8.8): A missing authentication vulnerability in the internal bandwidth test service (btest) that enables remote memory disclosure and denial-of-service against the router kernel.
• CVE-2026-86060 (CVSS 9.2): An improper neutralization of command argument delimiters allowing an unauthenticated adversary to modify the trusted RouterOS policy mask, achieving immediate privilege escalation to full administrative control.

JFrog Artifactory Exploitation Chain (CVE-2026-42016 & CVE-2026-42018)

Threat actors have been observed chaining two authorization vulnerabilities in self-hosted JFrog Artifactory instances alongside CVE-2026-82329 (CVSS 9.8) to compromise CI/CD build environments:

• CVE-2026-42016 (CVSS 8.1): Incorrect authorization logic that validates token signatures and issuers while failing to verify token scope boundaries, enabling privilege escalation.
• CVE-2026-42018 (CVSS 7.5): An improper authentication flaw that returns internal anonymous-user security tokens to unauthenticated callers even when anonymous access is explicitly disabled in the console.

Attack Vector & Impact

Threat intelligence telemetry demonstrates that multiple distinct threat groups are actively weaponizing these flaws for initial access and long-term persistence:

• ScreenConnect Remote Execution (T1219, T1059.005): Huntress researchers identified three separate intrusions where adversaries leveraged CVE-2026-84869 during active remote support sessions to deploy malicious Visual Basic Script (VBScript) payloads onto newly connected endpoints, executing elevated post-exploitation tasks.
• MikroTrick Perimeter Takeover (T1190, T1068): Attackers target internet-exposed MikroTik routers, executing the MikroTrick exploit chain to gain root privileges. Compromised routers are incorporated into malicious traffic redirection proxies, botnet infrastructure, and lateral movement launchpads into internal enterprise LANs.
• Supply Chain & CI/CD Compromise: As documented by Wiz researchers, attackers chaining the JFrog Artifactory flaws between August 15 and September 8, 2026, established persistent administrator accounts, deployed malicious Groovy plugins for native code execution, and installed compiled Rust-based backdoors to maintain persistent control over proprietary software repositories.

Detection & Mitigation

Network defenders and system administrators must enforce emergency patching across all affected assets in accordance with CISA's deadlines:

ConnectWise ScreenConnect Remediation

• Update Version: Upgrade all ScreenConnect endpoints immediately to version 26.6.5 or later.
• Session Telemetry Auditing: Audit ScreenConnect session logs for anomalous file transfer actions initiated without operator interaction.
• CISA FCEB Deadline: September 14, 2026.

MikroTik RouterOS Remediation

• Firmware Upgrades: Upgrade RouterOS instances immediately to the latest stable release (v7.16 or vendor-recommended build).
• Service Hardening: Disable the btest service on public interfaces via IP Services management if not strictly required.
• Management Access Filtering: Restrict WinBox, WebFig, and SSH access strictly to trusted administrative subnets and VPN tunnels.
• CISA FCEB Deadline: September 13, 2026.

JFrog Artifactory Remediation

• Patch Application: Apply official JFrog security updates addressing CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 across all self-hosted deployments.
• Audit Groovy Plugins: Inspect the /var/opt/jfrog/artifactory/etc/plugins directory for unauthorized or newly added Groovy scripts.
• Token Invalidation: Revoke and regenerate all administrative API keys and service access tokens issued prior to patch application.
• CISA FCEB Deadline: September 25, 2026.