CISA Adds Five Actively Exploited Artifactory, ScreenConnect and RouterOS Flaws to KEV
Summary
CISA added five actively exploited flaws in Artifactory, ScreenConnect and RouterOS to its KEV catalog. Reports describe privilege escalation, backdoor deployment and device takeover; agencies face September patch deadlines.
Key points
- CISA added five actively exploited vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to its KEV catalog.
- Attackers reportedly chained Artifactory flaws with CVE-2026-82329 to gain administrator control and deploy persistent accounts, malicious Groovy plugins and Rust-based backdoors.
- CVE-2026-84869 may allow unauthorized file transfer and execution through active ScreenConnect sessions; Huntress linked its exploitation to three incidents involving VBScript payloads.
- CERT Polska reported unknown actors exploiting two RouterOS flaws in the MikroTrick chain to take control of vulnerable devices without authentication.
- Federal agencies must patch the RouterOS flaws by September 13, the ScreenConnect flaw by September 14, and the Artifactory flaws by September 25, 2026.
- ConnectWise recommended updating ScreenConnect to version 26.6.5; the company said the flaw does not affect ScreenConnect servers.
Article Details
- Vulnerability Types
- Incorrect authorization
- Improper authentication
- Improper privilege management
- Missing authorization
- Missing authentication for a critical function
- Improper neutralization of argument delimiters in a command
- Severity
- CVSS scores range from 7.5 to 9.9.
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1059.005 · Visual BasicThreat actors used a malicious Visual Basic Script payload distributed through ScreenConnect.T1136.001 · Local AccountAttackers created persistent administrator accounts on compromised Artifactory servers.T1505.003 · Web ShellAttackers deployed malicious Groovy plugins on Artifactory servers for code execution and persistence.
CVE
Vendors
ConnectWiseCISA has added five actively exploited vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its KEV catalog.JFrogCISA has added five actively exploited vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its KEV catalog.MikroTikCISA has added five actively exploited vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its KEV catalog.
Products
ConnectWise ScreenConnectCISA has added five actively exploited vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its KEV catalog.JFrog ArtifactoryCISA has added five actively exploited vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its KEV catalog.MikroTik RouterOSCISA has added five actively exploited vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its KEV catalog.