Three unrelated products, one advisory
On September 12, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities across three separate vendors to its Known Exploited Vulnerabilities (KEV) catalog: ConnectWise ScreenConnect, MikroTik RouterOS, and JFrog Artifactory. A KEV listing is not a routine advisory. It triggers a binding deadline under CISA's binding operational directive requiring US federal civilian agencies to patch or mitigate, and it is CISA's clearest public signal that a flaw is not theoretical, it is already being used against real targets.
The three products have little in common on paper, a remote-support tool, a router operating system, and a software artifact repository, but they share a role: each sits in a position where compromising it hands an attacker a foothold across everything connected to it. That is almost certainly why CISA grouped them into a single advisory.
ConnectWise ScreenConnect: the most severe of the five
CVE-2026-84869 carries a CVSS score of 9.9, close to the maximum. It combines improper privilege management with a missing authorization check, and the practical effect is serious: an attacker can transfer files and execute code through a session that a legitimate technician already has open, without host approval. ConnectWise says the flaw lives in the ScreenConnect client rather than the server, and fixed it in version 26.6.5. CISA's deadline for federal agencies was September 14, effectively immediate. Security firm Huntress has documented incidents where compromised clients ran a four-stage VBScript chain to spread to newly connected systems, meaning exploitation predates the KEV listing by some margin and has already shown up in the field disguised as ordinary support activity.
Remote-support tools like ScreenConnect are an especially attractive target because a working session is, by design, already trusted by the endpoint on the other end. A flaw that lets an attacker ride along on someone else's active session skips most of the work an attacker would normally have to do.
MikroTik RouterOS: two bugs, one exploit chain
RouterOS carries two separate additions. CVE-2026-67277 (CVSS 8.8) is a missing-authentication flaw in the router's built-in bandwidth-test service, allowing kernel memory disclosure and denial of service. CVE-2026-86060 (CVSS 9.2) is a command-injection style flaw, an improper neutralization of argument delimiters, that lets an attacker escalate privileges by modifying RouterOS's policy masks. Chained together, researchers have nicknamed the pair "MikroTrick." CERT Polska has reported exploitation by unidentified threat actors. The federal patch deadline was September 13, meaning it has already passed as of this writing.
MikroTik routers run a huge installed base of small-business and ISP-edge equipment worldwide, which is exactly the kind of device that gets deployed once and rarely touched again, a profile attackers rely on when building long-lived botnets.
JFrog Artifactory: a second pair of flaws in the same campaign
This blog covered a separate Artifactory flaw, CVE-2026-82329, in early September, an authentication bypass letting attackers mint admin tokens with no login at all. The two CVEs added to KEV this week are different bugs in the same product, exploited by what appears to be the same attackers over the same window. CVE-2026-42016 (CVSS 8.1) is an incorrect-authorization flaw: Artifactory validates a token's signature and issuer but not what scope that token is actually allowed to act within, opening the door to privilege escalation. CVE-2026-42018 (CVSS 7.5) is an improper-authentication flaw that can hand an unauthenticated caller an internal anonymous-user token, leaking access to resources that should have required a login.
Between August 15 and September 8, attackers chained these two bugs together with the earlier CVE-2026-82329 to create persistent admin accounts, deploy malicious Groovy plugins, and install Rust-based backdoors on compromised Artifactory servers. The federal deadline for these two is September 25, giving defenders slightly more runway than the other four flaws in this advisory, though "more runway" here still means under two weeks from the KEV listing.
What it means in practice
If your organization runs any of these three products, treat the deadlines as a floor, not a target: exploitation for all five predates CISA's listing, in some cases by close to a month. For ScreenConnect, get to 26.6.5 and audit active session logs for unexpected file transfers. For RouterOS, patch and specifically check whether the bandwidth-test service is exposed to anything outside a trusted management network, it usually does not need to be. For Artifactory, patching alone will not undo an existing compromise, given how far back the exploitation window runs, so any internet-facing instance that has been unpatched since mid-August should be checked for the persistence markers researchers have already published, unexpected admin accounts and Groovy plugins chief among them, not just patched and assumed clean.
