CISA recently added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. Remediation deadlines range from September 13 to September 25, 2026, for federal agencies. If you're not treating these deadlines as your own, you're risking unnecessary exposure.
Recent Developments
CISA's latest KEV additions highlight three attack patterns currently active. Attackers have chained two Artifactory flaws (CVE-2026-42016 and CVE-2026-42018) with a previously cataloged vulnerability to gain administrator control over self-hosted servers. The ScreenConnect vulnerability (CVE-2026-84869) allows file transfer and execution through active remote sessions without host confirmation. The two RouterOS flaws (CVE-2026-67277 and CVE-2026-86060) enable attackers to control network devices without authentication.
These aren't theoretical risks. Wiz documented post-exploitation activities like persistent administrator accounts and malicious plugins in Artifactory compromises. Huntress observed threat actors using the ScreenConnect flaw to distribute malicious payloads across systems.
Key Findings
Vulnerability chaining is a primary escalation method. The Artifactory attack chain shows how attackers combine an incorrect authorization flaw (CVE-2026-42016) with an improper authentication vulnerability (CVE-2026-42018) to bypass security controls. CVE-2026-42016 fails to validate token scope, while CVE-2026-42018 leaks internal tokens. Alone, these vulnerabilities don't lead to full compromise, but together they enable privilege escalation.
Your patch prioritization should address these vulnerabilities together. Patching one without the other leaves you vulnerable.
Remote access tools can create significant exposure. The ScreenConnect flaw (CVE-2026-84869) affects the client component, not the server. This changes your remediation scope. You need to update every endpoint with the ScreenConnect client. Huntress documented real-world exploitation across multiple organizations.
The vulnerability allows attackers to run code with elevated privileges through a tool your team trusts for remote support.
Network infrastructure vulnerabilities offer persistent control. CERT Polska documented the MikroTik RouterOS exploit chain, named MikroTrick. CVE-2026-67277 allows kernel memory disclosure, while CVE-2026-86060 enables privilege escalation. Together, these flaws give attackers control over network routing and access control.
Network devices often receive less frequent patching than servers. If your RouterOS devices are vulnerable, they're persistent footholds for attackers.
CISA's remediation timelines reflect exploitation speed. Federal agencies must patch the RouterOS flaws by September 13, 2026, the ScreenConnect flaw by September 14, 2026, and the Artifactory flaws by September 25, 2026. These deadlines are based on observed exploitation activity and potential impact severity.
The RouterOS deadline signals immediate danger. The Artifactory deadline provides more time because the attack chain requires multiple steps, but active exploitation has been ongoing.
Post-exploitation activity establishes persistence quickly. Wiz's analysis shows attackers deploying backdoors after gaining Artifactory access. This isn't opportunistic scanning; it's deliberate infrastructure compromise. Persistent administrator accounts mean that even if you patch the initial vulnerability, attackers may retain access.
What This Means for Your Team
Your patch management process must account for chained vulnerabilities, not just individual CVEs. If you're using a simple severity-based queue, you'll miss the relationship between CVE-2026-42016 and CVE-2026-42018. Both need to be patched together to close the attack path.
Your remote access tool inventory must include client installations, not just server infrastructure. The ScreenConnect vulnerability affects endpoints, requiring endpoint deployment. Without an accurate inventory of where the ScreenConnect client is installed, you can't confirm you've closed the exposure.
Your network device patching can't lag behind server patching. RouterOS devices handle critical network segmentation and access control. If attackers control your routers, they control your network perimeter and internal traffic routing.
Action Items by Priority
Immediate (within 24 hours): Identify all systems running JFrog Artifactory, ConnectWise ScreenConnect client, and MikroTik RouterOS. Cross-reference against the five CVEs. If you're in a sector CISA designates as critical infrastructure, treat this as an emergency patch window.
Within 72 hours: Deploy patches for RouterOS (CVE-2026-67277 and CVE-2026-86060) and ScreenConnect client (CVE-2026-84869). These have the shortest CISA deadlines and documented active exploitation. For RouterOS, update to a version that addresses both vulnerabilities. For ScreenConnect, update to version 26.6.5 or later.
Within one week: Patch Artifactory installations (CVE-2026-42016 and CVE-2026-42018). Review administrator accounts created since August 15, 2026. Look for unauthorized Groovy plugins and check for unexpected outbound connections from Artifactory servers.
Within two weeks: Review your vulnerability chaining detection capabilities. Can your security tools identify when moderate-severity vulnerabilities combine to create critical exposure? If you're relying solely on individual CVE scores, you're missing key attack paths.
Ongoing: Establish a KEV monitoring process that triggers automatic review when CISA adds new entries. The KEV catalog isn't just guidance for federal agencies. It's a curated list of vulnerabilities with confirmed exploitation. Use it to drive your patch prioritization.
