CISA Expands Known Exploited Vulnerabilities Catalog to Include Critical Flaws in JFrog Artifactory ConnectWise ScreenConnect and MikroTik RouterOS
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive adding five significant security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. These additions, which impact widely utilized enterprise software and networking infrastructure, follow confirmed reports of active exploitation in the wild. The affected technologies—JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS—are foundational components in many corporate environments, making the current exploitation campaign a matter of significant concern for global cybersecurity operations.
The KEV catalog, maintained by CISA, serves as a critical repository of vulnerabilities that have been weaponized by threat actors. By mandating that Federal Civilian Executive Branch (FCEB) agencies address these specific flaws within strictly defined timeframes, CISA aims to mitigate the risk of large-scale systemic breaches. The current wave of activity highlights an increasing sophistication among adversaries, who are moving beyond isolated exploits to sophisticated, multi-stage attack chains.
The Anatomy of the JFrog Artifactory Campaign
The most severe of the newly identified threats involve JFrog Artifactory, a universal artifact repository manager. Between August 15 and September 8, 2026, security researchers identified a coordinated effort by threat actors to chain multiple vulnerabilities to achieve full administrative control over self-hosted Artifactory instances.
According to analysis provided by Google-owned security firm Wiz, the attack sequence is highly methodical. Threat actors have been observed leveraging CVE-2026-82329, which carries a critical CVSS score of 9.8, alongside other identified flaws to bypass authentication protocols. The implications of this breach are severe. Once an attacker gains administrative privileges, they are capable of deploying persistent backdoors, creating rogue administrator accounts, and injecting malicious Groovy plugins into the environment.
The use of Groovy plugins for code execution is particularly alarming, as it allows for arbitrary command execution at the system level. Furthermore, the deployment of Rust-based backdoors ensures that the attackers maintain a long-term presence on the network, effectively bypassing standard perimeter defenses. This persistent access allows for data exfiltration, lateral movement within the corporate network, and the potential for supply chain poisoning, given the central role Artifactory plays in the software development lifecycle (SDLC).
Exploitation of ConnectWise ScreenConnect
While the Artifactory incidents focused on server-side compromise, the vulnerabilities identified in ConnectWise ScreenConnect represent a different class of threat: client-side remote execution. Huntress, a managed security service provider, documented three separate incidents where attackers abused a specific condition in the ScreenConnect client to push malicious Visual Basic Script (VBScript) payloads to unsuspecting systems.
ConnectWise has clarified that this issue does not stem from a flaw in their server infrastructure but rather from the client-side logic. The vulnerability allows files to be transferred and executed through an active remote session without requiring authorization or confirmation from the host. In a professional remote support environment, this capability is a core feature; however, when weaponized, it grants an attacker the ability to bypass security controls and execute files with elevated privileges.
The security implications here are significant for Managed Service Providers (MSPs). Because ScreenConnect is designed for remote administration, it is inherently trusted by many endpoint security solutions. By exploiting this "trusted" pathway, attackers can deliver ransomware or information-stealing malware directly to end-user devices with minimal friction. Organizations are urged to upgrade to version 26.6.5 immediately to close this execution loophole.
MikroTik RouterOS and the MikroTrick Campaign
The third component of this CISA update concerns the networking layer, specifically MikroTik RouterOS. Reports from CERT Polska have detailed an exploit chain dubbed "MikroTrick," which allows unauthorized actors to seize control of routers without the need for authentication.
Routers serve as the gateways to an organization’s network, and compromising them provides attackers with a bird’s-eye view of all incoming and outgoing traffic. The ability to control a router without credentials suggests a fundamental flaw in the device’s authentication or management interface. By hijacking these devices, attackers can redirect traffic, intercept sensitive communications, and establish a beachhead from which they can launch further attacks on internal assets. The speed with which these vulnerabilities were added to the KEV catalog underscores the urgency of securing edge devices, which often remain unpatched due to the perceived difficulty of maintenance.
Chronology of Mandated Remediation
CISA has established a strict, tiered timeline for remediation to prevent the further spread of these exploits. Federal agencies are held to the following deadlines:
- September 13, 2026: Deadline for patching the identified vulnerabilities in MikroTik RouterOS (CVE-2026-67277 and CVE-2026-86060).
- September 14, 2026: Deadline for addressing the vulnerability in the ConnectWise ScreenConnect client.
- September 25, 2026: Deadline for resolving the critical JFrog Artifactory security flaws.
While these deadlines are specifically binding for FCEB agencies, CISA strongly encourages private sector organizations, critical infrastructure providers, and state and local governments to adhere to these timelines as well. The presence of these vulnerabilities in the KEV catalog is a strong indicator that automated scanners used by cybercriminals are actively searching for unpatched systems.
Analysis of Implications for Enterprise Security
The current landscape reflects a transition toward "chaining" exploits. As security software becomes more adept at detecting single-CVE attacks, adversaries are increasingly looking for ways to combine smaller, less-noticed bugs into a unified kill chain. The JFrog incident is a prime example, where multiple flaws, each perhaps manageable on its own, were combined to achieve a total takeover of the server infrastructure.
Furthermore, the focus on ScreenConnect and MikroTik highlights a trend toward targeting the tools that administrators use to manage their environments. By compromising the management plane, attackers gain a "force multiplier" effect—one compromised administrative account or router can facilitate the infection of dozens or hundreds of downstream endpoints.
Organizations should adopt a "zero-trust" posture regarding their administrative tools. This includes implementing stricter network segmentation for remote support tools, requiring multi-factor authentication (MFA) even for internal management traffic, and maintaining rigorous patch management cycles for all edge-facing hardware and CI/CD pipeline software.
Conclusion and Recommendations
The rapid escalation of these vulnerabilities from discovery to widespread exploitation serves as a stark reminder of the volatile nature of modern cybersecurity. For IT departments, the window between vulnerability disclosure and active, weaponized exploitation is narrowing.
In addition to applying the mandatory patches, security teams are advised to:
- Audit Logs: Review logs for anomalous administrative activity, particularly in JFrog Artifactory, looking for unauthorized plugin installations or suspicious account creation.
- Monitor Remote Sessions: Keep a close watch on remote support sessions initiated via ScreenConnect to ensure they originate from verified support personnel.
- Hardening: Ensure that MikroTik routers are not exposed to the public internet unless absolutely necessary, and if they are, ensure they are placed behind additional layers of authentication or VPN tunnels.
As the industry moves toward the end of 2026, the priority remains the same: the rapid identification and neutralization of vulnerabilities before they can be leveraged to disrupt business operations. Organizations that fail to act within the timelines set forth by CISA risk not only the integrity of their data but also the operational continuity of their entire enterprise infrastructure.
