News › security
By Zayden R., September 13, 2026
CISA has added five vulnerabilities in JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog due to active exploitation. Engineers should assess their systems for exposure and apply necessary patches.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced the inclusion of five new vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog, targeting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. This move follows reports of these flaws being actively exploited in the wild, posing significant risks to affected systems.
The vulnerabilities include two in JFrog Artifactory, CVE-2026-42016, and CVE-2026-42018, with CVSS scores of 8.1 and 7.5 respectively. The first is an authorization flaw that permits privilege escalation due to improper validation of token signatures. The second involves improper authentication, potentially leaking sensitive resources by returning an internal anonymous-user token when anonymous access is disabled.
ConnectWise ScreenConnect suffers from CVE-2026-84869, a critical vulnerability with a CVSS score of 9.9. This flaw allows attackers to execute file transfers and remote sessions without authorization, significantly increasing the risk of unauthorized access and data breaches.
MikroTik RouterOS is affected by two vulnerabilities, CVE-2026-67277 and CVE-2026-86060, with scores of 8.8 and 9.2. The former involves missing authentication for critical functions, leading to kernel memory disclosure and potential denial-of-service attacks. The latter allows privilege escalation by altering trusted RouterOS policy masks.
Notably, attackers have been observed chaining the Artifactory vulnerabilities with CVE-2026-82329 to gain administrative control of self-hosted servers, as reported by Google-owned Wiz. Post-exploitation activities have included creating persistent administrator accounts and deploying malicious plugins and backdoors.
Engineers and sysadmins are advised to promptly assess their systems for these vulnerabilities and apply patches or mitigations where available. The addition of these flaws to the KEV catalog underscores the critical nature of maintaining robust security practices and staying informed about active threats.