CISA Adds Critical JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS Vulnerabilities to Known Exploited Vulnerabilities Catalog

The United States Cybersecurity and Infrastructure Security Agency (CISA) has taken decisive action to secure the federal enterprise by mandating the remediation of five high-severity security flaws currently being actively leveraged by threat actors. These vulnerabilities, which span across critical software used in development, remote management, and network infrastructure, have been officially added to the Known Exploited Vulnerabilities (KEV) catalog. The move underscores an escalating trend of sophisticated cyber-adversaries chaining disparate exploits to achieve persistence, escalate privileges, and maintain long-term access within victim environments.

The Scope of the Threat

The newly cataloged vulnerabilities impact three major technology platforms: JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. By including these in the KEV list, CISA has effectively signaled to both Federal Civilian Executive Branch (FCEB) agencies and private-sector entities that the risk of compromise is no longer theoretical but a present, ongoing reality.

The inclusion follows a flurry of research reports from industry leaders, including Wiz, Huntress, and CERT Polska, which highlighted the specific methodologies used by attackers. These reports indicate that the attackers are not merely seeking opportunistic access but are instead focusing on high-value targets—such as software build servers and network routing equipment—to facilitate supply chain compromises and lateral movement.

Chronology of Exploitation and Discovery

The timeline of these events suggests a coordinated effort by threat actors to maximize their reach across diverse technology stacks.

• August 15 – September 8, 2026: Attackers were observed orchestrating a sophisticated campaign against self-hosted JFrog Artifactory instances. This campaign involved chaining multiple vulnerabilities to bypass authentication mechanisms and deploy persistent backdoors.
• Early September 2026: Research teams began documenting the "MikroTrick" exploit chain, which targeted MikroTik RouterOS devices, effectively seizing control without requiring any form of authentication.
• September 8, 2026: ConnectWise issued a security bulletin regarding an unauthorized file transfer and execution condition within their ScreenConnect client software.
• September 10-11, 2026: CISA formally issued emergency directives and added these five vulnerabilities to the KEV catalog, setting strict remediation deadlines for federal agencies.

JFrog Artifactory: The Supply Chain Target

JFrog Artifactory, a widely used repository manager that acts as the backbone for many DevOps and software supply chain pipelines, has become a primary target for sophisticated threat actors. The current exploitation involves the chaining of two specific vulnerabilities alongside CVE-2026-82329—a critical flaw boasting a CVSS score of 9.8.

According to security researchers at Wiz, the exploit chain is highly modular. Once the initial authentication bypass is achieved, attackers move to elevate their privileges to the administrator level. From there, they inject malicious Groovy scripts—a capability native to Artifactory—to execute arbitrary code. The ultimate objective observed in these instances is the installation of Rust-based backdoors, which are notoriously difficult to detect with traditional signature-based antivirus solutions due to their memory-resident nature and obfuscation techniques.

The implication for the software supply chain is profound. If a build server is compromised, attackers can potentially inject malicious code into the software artifacts being produced, creating a "SolarWinds-style" scenario where the vulnerability is distributed downstream to the organization’s customers.

ConnectWise ScreenConnect and the Risk of Remote Access

The threat involving ConnectWise ScreenConnect represents a different, yet equally dangerous, attack vector. Unlike the Artifactory attacks, which focus on server infrastructure, the flaw identified by Huntress targets the client-side software.

The vulnerability, identified as CVE-2026-84869, allows for unauthorized file transfer and execution during an active remote session. In many cases, these sessions are initiated by technicians for legitimate support purposes, but the flaw allows an attacker to bypass standard host confirmation prompts. This enables the silent installation of malicious Visual Basic Script (VBScript) payloads.

Huntress analysts noted that this is particularly dangerous because it subverts the "trust" model of remote desktop software. When a technician is connected, the user expects that all actions are authorized. By exploiting this "condition," attackers can gain a foothold on the client machine, potentially stealing credentials or sensitive data while remaining undetected under the cover of a legitimate session. Organizations are being urged to upgrade to version 26.6.5 immediately to mitigate this risk.

MikroTrick: Hijacking Network Infrastructure

The exploitation of MikroTik RouterOS, dubbed "MikroTrick" by researchers at CERT Polska, highlights the vulnerability of the "edge" of the network. Because routers and gateways are often the first line of defense, they are rarely scanned for vulnerabilities with the same frequency as application servers.

The two vulnerabilities, CVE-2026-67277 and CVE-2026-86060, allow for unauthenticated remote code execution. By hijacking these devices, threat actors can intercept, modify, or redirect network traffic, essentially turning the organization’s own infrastructure against itself. This level of access is often a precursor to man-in-the-middle (MitM) attacks, where encrypted traffic is decrypted, inspected, and re-encrypted before reaching its final destination, providing attackers with a treasure trove of sensitive information.

Official Directives and Compliance

CISA’s mandate is not merely a recommendation; it is a regulatory requirement for FCEB agencies. The deadlines are staggered to account for the severity and the difficulty of patching:

1. MikroTik RouterOS (CVE-2026-67277, CVE-2026-86060): Must be patched by September 13, 2026.
2. ConnectWise ScreenConnect (CVE-2026-84869): Must be patched by September 14, 2026.
3. JFrog Artifactory Vulnerabilities: Must be patched by September 25, 2026.

While these mandates apply directly to government agencies, CISA strongly advises private sector organizations to align their internal patch management cycles with these timelines. The agency’s KEV catalog serves as a "living document" that reflects the current reality of the threat landscape. Ignoring these updates can leave an organization exposed to the same tactics currently being used to compromise high-value targets.

Analysis: The Shift Toward Chained Exploits

The recent wave of activity involving these five vulnerabilities illustrates a broader evolution in cyber-adversary behavior. We are seeing a move away from "single-shot" exploits toward "exploit chains." By combining multiple minor vulnerabilities—or several critical ones—attackers can create a bypass of layered security controls that would normally stop a simpler attack.

For example, in the JFrog Artifactory incident, the combination of an authentication bypass and a code-execution plugin allows the attacker to move through the entire lifecycle of an attack within a single system. This makes incident response significantly more difficult. Traditional security monitoring tools that look for a single "event" (like a failed login) may fail to capture the subtle, sequential steps of a chained exploit.

Furthermore, the focus on backdoors written in memory-safe or cross-platform languages like Rust, or the use of native scripting engines like Groovy and VBScript, demonstrates a sophisticated understanding of modern server environments. These attackers are not using "script kiddie" tools; they are performing reconnaissance, identifying the specific software versions in use, and crafting surgical attacks that bypass standard security boundaries.

Strategic Recommendations for Organizations

To defend against these types of threats, organizations must adopt a proactive security posture that extends beyond basic patching.

First, Identity and Access Management (IAM) must be hardened. Even if an authentication bypass exists, multifactor authentication (MFA) that is not tied solely to the application’s native login can act as a circuit breaker. Second, Network Segmentation is crucial. If a router or a build server is compromised, the impact should be limited to that specific segment, preventing the attacker from gaining lateral access to the rest of the corporate network.

Finally, organizations should implement Endpoint Detection and Response (EDR) solutions that are capable of behavioral analysis. Since these exploits often involve legitimate system tools (like VBScript or plugins) to perform malicious acts, simple antivirus software will likely miss the threat. Behavioral monitoring can identify when a process—even one that appears legitimate—begins acting in an anomalous way, such as attempting to connect to an external command-and-control server or creating persistent administrative accounts.

As the cybersecurity landscape continues to evolve, the ability to rapidly ingest threat intelligence—such as the data provided by CISA—and translate it into operational security changes will define the difference between a secure organization and one that falls victim to the next major campaign. The inclusion of these five flaws in the KEV catalog is a stark reminder that in the modern digital age, vulnerability management is not a periodic task, but a continuous requirement.