The U.S. Cybersecurity and Infrastructure Safety Company (CISA) has added 5 safety flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Recognized Exploited Vulnerabilities (KEV) catalog, following studies of lively exploitation within the wild.
Particulars of the vulnerabilities are as follows –
- CVE-2026-42016 (CVSS rating: 8.1) – An incorrect authorization vulnerability in JFrog Artifactory that would result in privilege escalation resulting from a validation examine of the token signature/issuer and never the token’s scope.
- CVE-2026-42018 (CVSS rating: 7.5) – An improper authentication vulnerability in JFrog Artifactory that would return an inner anonymous-user token to an unauthenticated caller when nameless entry is disabled, probably leaking delicate assets.
- CVE-2026-84869 (CVSS rating: 9.9) – An improper privilege administration and lacking authorization vulnerability in ConnectWise ScreenConnect that would enable an attacker to file switch and execute by means of an lively distant session with out authorization or host affirmation.
- CVE-2026-67277 (CVSS rating: 8.8) – A lacking authentication for a essential perform vulnerability in MikroTik RouterOS that would enable kernel reminiscence disclosure and denial-of-service within the btest service.
- CVE-2026-86060 (CVSS rating: 9.2) – An improper neutralization of argument delimiters in a command vulnerability in MikroTik RouterOS that would enable an attacker to alter the trusted RouterOS coverage masks and obtain privilege escalation.
As beforehand reported by The Hacker Information, attackers have been noticed chaining the 2 Artifactory bugs alongside CVE-2026-82329 (CVSS rating: 9.8) to take administrator management of self-hosted servers and deploy backdoors between August 15 and September 8, 2026. CVE-2026-82329 was added to CISA’s KEV catalog earlier this month.
“Attackers are chaining these vulnerabilities to bypass authentication, escalate privileges, and acquire administrative management over susceptible Artifactory cases,” Google-owned Wiz mentioned. “Noticed post-exploitation exercise consists of the creation of persistent administrator accounts, the deployment of malicious Groovy plugins for code execution, and the set up of Rust-based backdoors to determine persistence.”
The exploitation of CVE-2026-84869, however, has been linked to a set of three unrelated incidents documented by Huntress through which risk actors abused ScreenConnect to distribute a malicious Visible Primary Script (VBScript) payload to newly related methods.
ConnectWise has described the flaw as a “situation” within the ScreenConnect shopper that “could enable information to be transferred and executed by means of an lively distant session with out authorization or Host affirmation in sure circumstances.” The difficulty doesn’t impression ScreenConnect servers.
“Underneath sure circumstances, this might allow information to be transferred to and executed on the Host shopper system, together with by means of elevated execution actions,” Huntress mentioned in an replace, urging organizations to replace to ScreenConnect model 26.6.5.
CISA’s addition of CVE-2026-67277 and CVE-2026-86060 follows a report from CERT Polska final week through which it mentioned it noticed unknown risk actors exploiting two flaws in MikroTik RouterOS to grab management of susceptible gadgets with out authentication. The cybersecurity company dubbed the exploit chain MikroTrick.
Federal Civilian Government Department (FCEB) businesses are required to patch the RouterOS flaws by September 13, 2026, the ScreenConnect flaw by September 14, 2026, and the Artifactory flaws by September 25, 2026.
