The U.S. Cybersecurity and Infrastructure Security Agency (CISA) just dropped five new vulnerabilities into its Known Exploited Vulnerabilities (KEV) catalog, and if you are running any of the affected software — JFrog Artifactory, ConnectWise ScreenConnect, or MikroTik RouterOS — you need to treat this as an emergency.
Attackers are already chaining these bugs together. Between August 15 and September 8, 2026, multiple threat groups have been observed exploiting Artifactory flaws to take administrator-level control of self-hosted servers and deploy backdoors. And CERT Polska has documented a two-bug RouterOS exploit chain they have dubbed “MikroTrick” that gives attackers full device control without authentication. This is not hypothetical. This is happening right now.
What Got Added to KEV?
CISA added five CVEs in three product families on September 12:
JFrog Artifactory (DevOps artifact registry)
CVE-2026-42016 (CVSS 8.1) — Incorrect authorization. The token signature check validates the issuer but not the token’s scope, allowing privilege escalation.
CVE-2026-42018 (CVSS 7.5) — Improper authentication. Even with anonymous access disabled, an unauthenticated caller can get an internal anonymous-user token, leaking sensitive resources.
Attackers are chaining these two with a third flaw — CVE-2026-82329 (CVSS 9.8) — to grab admin control of self-hosted Artifactory instances. FCEB agencies must patch by September 25.
ConnectWise ScreenConnect (remote access tool)
CVE-2026-84869 (CVSS 9.9) — Improper privilege management and missing authorization. During an active remote session, the attacker can transfer and execute files on the host without user confirmation. Huntress reported that the bug affects the client side, not the server. Update to version 26.6.5 immediately. FCEB deadline: September 14.
MikroTik RouterOS (routers and wireless ISP gear)
CVE-2026-67277 (CVSS 8.8) — Missing authentication for a critical function in the btest service, allowing kernel memory disclosure and denial of service.
CVE-2026-86060 (CVSS 9.2) — Improper neutralization of command argument delimiters, letting an attacker change the RouterOS policy mask and escalate privileges.
CERT Polska observed unknown threat actors chaining both flaws to seize control of vulnerable devices with zero authentication. They named the campaign MikroTrick. The CISA deadline for these has already passed (September 13), meaning federal agencies should have patched by now — and so should you.
Why This Matters
What makes this batch different from a typical CISA KEV drop is the breadth. We are not talking about one obscure product. JFrog Artifactory is central to DevOps pipelines at thousands of organizations. ScreenConnect is one of the most popular remote desktop tools for MSPs. MikroTik RouterOS powers routers and wireless gear globally, especially in ISPs and small-to-medium businesses.
If you run Artifactory, an attacker who chains these bugs gets:
– Admin control of your artifact registry
– The ability to inject backdoored code into your build pipeline
– Access to credentials and API tokens stored in the platform
If you run ScreenConnect, an attacker in an active session can silently push and execute files on your endpoints without any popup or confirmation.
If you run MikroTik RouterOS, an attacker on the network can take over the device completely, redirect traffic, and use it as a pivot point deeper into your network.
These are the scenarios that lead to full network compromise.
What You Need to Do
1. Patch Artifactory now. Update to the latest JFrog Artifactory self-hosted release. If you are on an older version, check JFrog’s security advisories page and upgrade immediately. Rotate any API tokens and credentials that were stored on an internet-exposed instance during the exploitation window (August 15 onward).
2. Update ScreenConnect to 26.6.5. ConnectWise pushed this fix. The server side is not affected, but every client endpoint that connects to ScreenConnect sessions needs the update. If you manage ScreenConnect for clients, push the update across all hosts.
3. Update MikroTik RouterOS. MikroTik has released patches addressing CVE-2026-67277 and CVE-2026-86060. Check your RouterOS version and update to the latest stable release. If you cannot patch immediately, restrict access to the btest service and limit administrative network access.
4. Check for signs of compromise. On Artifactory instances, look for unexpected admin accounts, unfamiliar API tokens, and unauthorized reverse shell processes. On MikroTik devices, check for unexpected firewall rules, routing changes, and unknown user accounts. On ScreenConnect hosts, review session logs for unauthorized file transfers.
5. Assume the worst if you were exposed. If any of these systems were internet-facing and unpatched during the known exploitation window, rotate every credential that touched them and audit for backdoors.
The Bottom Line
CISA does not add CVEs to the KEV catalog lightly. Five flaws in three major products all hitting the catalog on the same day means defenders need to move fast. The Artifactory chain alone — combining two auth bugs with a CVSS 9.8 RCE — is a textbook supply-chain attack vector. The MikroTik “MikroTrick” chain gives attackers unfettered access to networking infrastructure.
Check your stack. Patch what is vulnerable. Audit what was exposed. This wave is not slowing down.