CISA KEV Deadline Turns Artifactory, ScreenConnect and RouterOS Bugs Into an Urgent Patch Queue
CISA KEV Deadline Turns Artifactory, ScreenConnect and RouterOS Bugs Into an Urgent Patch Queue
Security teams have a narrow window to treat five newly cataloged exploited vulnerabilities as one operational priority, not five disconnected tickets. CISA added flaws in JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog after reports of active exploitation in the wild, putting hard remediation dates around systems that often sit close to sensitive software delivery, remote support and network edge functions.
The most important takeaway is simple: this is a patch-and-hunt moment. Organizations should update affected products immediately, but they should also assume that exposed self-hosted software repositories, remote management sessions and internet-facing routers may already have been touched. The vulnerabilities hit different platforms, yet they share the same defender problem: each one can become a privileged foothold if it is treated as a routine vulnerability instead of a confirmed exploitation signal.
What CISA Added
CISA's latest KEV additions cover two JFrog Artifactory vulnerabilities, one ScreenConnect client issue and two MikroTik RouterOS flaws. The Artifactory pair, CVE-2026-42016 and CVE-2026-42018, relate to authorization and authentication weaknesses. The ScreenConnect issue, CVE-2026-84869, affects the client side of remote sessions and may allow file transfer and execution without the expected authorization or host confirmation in certain circumstances. The RouterOS bugs, CVE-2026-67277 and CVE-2026-86060, involve missing authentication for a critical function and command argument handling that can support privilege escalation.
That product mix matters. Artifactory is not just another web application; in many environments it is part of the build and release chain. ScreenConnect is a remote access tool with legitimate administrative reach. RouterOS commonly sits at the edge, where exploitation can give attackers a durable position for traffic interception, pivoting or follow-on compromise.
Federal civilian agencies have specific deadlines: RouterOS fixes were due September 13, ScreenConnect by September 14 and the Artifactory bugs by September 25. Private-sector teams should read those dates as a prioritization signal rather than a public-sector-only compliance detail.
Why Artifactory Needs Extra Attention
The Artifactory exposure is especially sensitive because attackers have reportedly chained the newly cataloged bugs with CVE-2026-82329, an earlier critical authentication bypass affecting self-hosted deployments. Security reporting around that exploitation described attackers minting administrator-level tokens, creating persistence and abusing the platform in ways that could put software artifacts, credentials and build pipelines at risk.
That is where the issue starts to move from "patch a vulnerable server" into supply chain attack territory. A compromised artifact repository can become a staging point for tampered packages, poisoned builds or lateral movement into deployment infrastructure. Even if there is no evidence of downstream tampering, defenders should review administrative accounts, access tokens, plugin activity, recent artifact changes and integrations with CI/CD systems.
JFrog has advised self-hosted customers to move to fixed versions for the relevant issues. Cloud-hosted customers may have a different exposure path, but self-hosted environments should not wait for proof-of-compromise before tightening access and reviewing logs.
ScreenConnect Raises the RMM Risk Again
ConnectWise says the ScreenConnect 26.6.5 update addresses a condition in the client that could allow files to be transferred and executed through an active remote session without authorization or host confirmation. The company has said ScreenConnect servers are not affected, but the client-side impact is still serious because remote management tools already operate inside a high-trust lane.
Huntress linked exploitation activity to incidents where threat actors abused ScreenConnect to deliver malicious payloads. That means defenders should treat patching as only the first step. Review active and recently closed sessions, file transfer events, script execution, newly installed clients and any unexpected use of remote monitoring and management tooling. In environments where RMM access is broadly delegated, it is also worth confirming which roles can transfer files, run commands and initiate elevated actions.
For teams that cannot update immediately, temporary reduction of risky permissions may lower exposure, but it should not become the final mitigation. The permanent fix is the update path.
RouterOS Exposure Is an Edge Problem
The MikroTik RouterOS entries reinforce a familiar pattern: internet-exposed network devices remain valuable because they combine reachability, privilege and persistence. Reporting tied the RouterOS flaws to active exploitation against vulnerable devices, with one chain described as enabling attackers to seize control without authentication.
For defenders, this is not only about installing a firmware update. Router management interfaces should be removed from direct internet exposure wherever possible. SSH, WinBox, API access and testing services should be limited to VPN or trusted administrative ranges. Teams should also check for unexpected users, scripts, scheduler tasks, firewall changes, proxy settings, DNS manipulation and unusual outbound connections.
Network devices are often under-logged compared with servers and endpoints. That makes configuration review and known-good backups especially important after a KEV entry confirms real-world exploitation.
A Practical Response Plan
Start by inventorying affected assets. Look for self-hosted JFrog Artifactory, ScreenConnect clients and on-prem deployments, plus MikroTik RouterOS devices across branch offices, labs, MSP-managed customer environments and forgotten edge networks. KEV-driven response should begin with exposure, not ticket ownership.
Then patch in risk order. Prioritize internet-facing RouterOS, ScreenConnect environments where remote sessions are active or customer-facing, and Artifactory instances that hold production artifacts, secrets, tokens or build integrations. For Artifactory, include any related CVE-2026-82329 remediation if it has not already been completed.
After patching, hunt for signs of misuse. In Artifactory, review administrator token creation, new users, plugin changes, Groovy execution, suspicious repository changes and CI/CD credential access. In ScreenConnect, review file transfer, execution and client deployment events. In RouterOS, compare current configuration against a trusted baseline and rotate credentials if there is any sign of unauthorized access.
Finally, shorten the future blast radius. Artifact repositories should have scoped tokens, strong identity controls and monitored administrative actions. RMM tools should have tight role separation and session auditing. Router management should not be exposed to the public internet. These controls do not remove the need to patch, but they make the next exploited CVE less likely to become a full compromise.
The Bottom Line
These KEV additions are not just a list of new CVEs. They are a reminder that attackers continue to target infrastructure products that sit near the software supply chain, remote administration and the network edge. If your environment runs any of the affected products, today is the day to verify versions, apply fixes and review logs for suspicious activity.
The organizations that handle this well will not be the ones that simply close patch tickets. They will be the ones that ask the harder question: if this was exploited yesterday, what would the attacker have been able to reach next?
References
FAQ
Security teams have a narrow window to treat five newly cataloged exploited vulnerabilities as one operational priority, not five disconnected tickets. CISA added flaws in JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog after reports of active exploitation in the wild, putting hard remediation dates around systems that often sit close to sensitive...
Start by inventorying affected assets. Look for self-hosted JFrog Artifactory, ScreenConnect clients and on-prem deployments, plus MikroTik RouterOS devices across branch offices, labs, MSP-managed customer environments and forgotten edge networks. KEV-driven response should begin with exposure, not ticket ownership.