CISA adds 5 exploited bugs to KEV catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vuln
What Happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, spanning JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. The most notable entry is CVE-2026-42016, a privilege escalation flaw in JFrog Artifactory.
KEV inclusion requires evidence of exploitation in the wild and triggers a binding remediation deadline for U.S. federal agencies under BOD 22-01. Private-sector organizations are urged to treat the same timeline as a baseline.
Why It Matters
These three products sit in sensitive positions. Artifactory is the artifact hub for CI/CD pipelines, ScreenConnect provides remote access to endpoints, and RouterOS powers edge routing at countless SMBs and ISPs. A working exploit in any one of them can become an initial foothold or a lateral-movement bridge.
The combination is what raises concern. Attackers who chain an edge router compromise with a remote-access tool and then pivot into a build system can move from perimeter to supply chain without ever touching a user endpoint. Mandiant and CISA have documented this playbook repeatedly over the past three years.
Technical Details
CVE-2026-42016 in JFrog Artifactory allows an authenticated low-privilege user to escalate to administrative control, which can expose stored credentials, signing keys, and package repositories. For ScreenConnect, the flagged flaw involves authentication bypass or code execution on the server component, a class that has been targeted since the 2024 SlashAndGrab campaign. The MikroTik RouterOS issue is a remote vector in the router’s management surface, following the pattern of prior exploits against Winbox and the RouterOS API.
Public proof-of-concept code is not required for KEV listing, so defenders should assume weaponized tooling already exists in criminal and state-aligned hands.
Immediate Risk
Federal agencies face a compressed patch window. Everyone else should assume active scanning: mass internet scans for Artifactory and RouterOS management interfaces typically begin within 72 hours of KEV listing. ScreenConnect servers exposed to the internet are the highest-priority target because a single compromise can yield persistent remote access across an entire customer base.
Prioritize internet-facing ScreenConnect and RouterOS instances first, then Artifactory behind the perimeter. Check logs for anomalous admin account creation, unexpected API tokens, and new ScreenConnect sessions from unfamiliar geographies.
Security Insight
The common thread is that each product was designed to be trusted rather than monitored. Artifactory, ScreenConnect, and RouterOS all generate traffic and administrative actions that most SOCs treat as normal. That assumption is exactly what attackers exploit: the breach looks like routine DevOps activity.
A useful historical parallel is the 2021 Kaseya VSA incident, where attackers abused an RMM platform’s own privileged position to reach downstream customers. The defensive lesson then and now is to instrument the trusted tools themselves, not just the endpoints they manage. Baseline what normal admin behavior looks like in these systems before an incident, or you will have no way to distinguish an attacker from a busy engineer during one.
Further Reading
Never miss a security update
Get real-time security alerts delivered to your preferred platform.
Related News
GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure. The vulnerability in
Cisco Talos says two recently patched Secure Firewall Management Center (FMC) vulnerabilities have been exploited by three separate threat clusters linked to ransomware and state-sponsored attacks. [.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog, requ
Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe. The Arctic Wolf Adversary Research Team