# CISA Adds 5 Actively Exploited Vulnerabilities to KEV Catalog Critical flaws in Artifactory, ScreenConnect, and RouterOS under active attack - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-12 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/48a5eb6c-fa09-4b5a-b428-9d51282f007d ## Critical Vulnerabilities Added to KEV Catalog CISA has flagged five actively exploited vulnerabilities in JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. These flaws enable attackers to bypass authentication, escalate privileges, and gain full system control. The vulnerabilities are being chained together in real-world attacks, with observed incidents dating back to August 2026. Federal agencies have strict patching deadlines ranging from September 13-25, 2026. ## Artifactory Exploit Chain Details Attackers are combining two Artifactory bugs with CVE-2026-82329 (CVSS 9.8) to take over self-hosted servers. Google's Wiz observed post-exploitation activities including creating admin accounts, deploying malicious Groovy plugins, and installing Rust-based backdoors. The attacks occurred between August 15 and September 8, 2026, targeting administrator controls. This vulnerability was added to CISA's KEV catalog earlier this month. ## ScreenConnect Vulnerability Impact CVE-2026-84869 allows unauthorized file transfers during remote sessions. Huntress documented three incidents where threat actors abused ScreenConnect to distribute malicious VBScript payloads. ConnectWise notes the flaw only affects client systems, not servers. Organizations must update to ScreenConnect version 26.6.5 immediately. The vulnerability enables elevated execution actions on host systems under specific conditions. ## RouterOS Exploit Chain CERT Polska reported unknown actors exploiting MikroTik RouterOS flaws CVE-2026-67277 and CVE-2026-86060. Dubbed 'MikroTrick', this attack chain takes control of devices without authentication. CISA requires federal agencies to patch RouterOS systems by September 13, 2026. The exploits demonstrate how attackers combine multiple vulnerabilities for greater impact. MikroTik devices are widely used in network infrastructure globally. ## Exploitation Timeline Artifactory attacks occurred August 15-September 8, 2026. ScreenConnect incidents were documented throughout August. RouterOS exploits were reported last week. Federal agencies have staggered patching deadlines: RouterOS by September 13, ScreenConnect by September 14, and Artifactory by September 25. This timeline shows attackers' rapid weaponization of new vulnerabilities. ## Post-Exploitation Activities Attackers establish persistence through multiple methods: creating admin accounts, deploying malicious plugins, and installing backdoors. The Rust-based backdoors in Artifactory attacks are particularly concerning due to their stealth. ScreenConnect attacks deliver VBScript payloads to new connections. RouterOS compromises enable full device control. These techniques show sophisticated post-exploitation tradecraft. ## Mitigation Requirements Federal agencies must patch systems on strict schedules. ScreenConnect requires version 26.6.5. Artifactory administrators should monitor for new accounts and plugins. RouterOS users should verify authentication controls. CISA recommends testing environments for exploitability and prioritizing high-risk exposures. The agency emphasizes preemptive action before AI-powered attacks increase threat velocity. ## Broader Security Implications These vulnerabilities affect critical infrastructure components. Artifactory is used for software artifacts, ScreenConnect for remote access, and RouterOS in network devices. Their exploitation demonstrates attackers' focus on supply chain and access systems. The coordinated response highlights growing public-private cybersecurity collaboration. Organizations should view these as warning signs to strengthen defenses. ## Sources covering this story - https://thehackernews.com/2026/09/cisa-adds-5-actively-exploited.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._