CISA Adds Five Actively Exploited Flaws in Artifactory, ScreenConnect, and RouterOS to KEV Catalog

On September 12, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on confirmed reports of active exploitation in the wild. The vulnerabilities affect widely used products from JFrog, ConnectWise, and MikroTik, raising concerns for enterprises and network operators.

What happened?
CISA's KEV catalog now includes five vulnerabilities impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. The agency's action signals that these flaws are being actively leveraged by threat actors, and it mandates federal civilian agencies to patch them by a specified due date. While the full list of CVEs was not disclosed in the initial advisory, one identified vulnerability is CVE-2026-42016, an incorrect authorization issue in JFrog Artifactory with a CVSS score of 8.1.

Who is affected?
Organizations using JFrog Artifactory for software artifact management, ConnectWise ScreenConnect for remote support, and MikroTik RouterOS for network routing are potentially at risk. The impact spans sectors including technology, managed service providers, and telecommunications, with global implications given the widespread adoption of these products.

Technical details
CVE-2026-42016 (CVSS 8.1) is an incorrect authorization vulnerability in JFrog Artifactory, which could allow an attacker to gain unauthorized access or escalate privileges. The other four vulnerabilities, while not fully detailed in the available information, are similarly rated as actively exploited and likely involve remote code execution, authentication bypass, or privilege escalation, given the nature of the affected products.

Why it matters
Active exploitation of these flaws poses a significant risk to organizations, as attackers can potentially compromise critical infrastructure, steal sensitive data, or deploy ransomware. The inclusion in CISA's KEV catalog underscores the urgency for patching, as threat actors often move quickly after public disclosure.

Known exploitation
CISA added these vulnerabilities to the KEV catalog based on reports of active exploitation. Specific exploit details are not provided in the advisory, but the agency's action confirms that real-world attacks are occurring. Organizations should assume that threat actors have access to exploit methods and act accordingly.

What organizations should do
Immediately apply vendor-provided patches for JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. If patches are not yet available, implement temporary mitigations such as restricting network access, enabling multi-factor authentication, and monitoring for suspicious activity. Federal agencies must comply with CISA's binding operational directive, which sets a deadline for remediation.

Mitigation and patch information
Vendors have likely released security updates; consult official advisories from JFrog, ConnectWise, and MikroTik for specific patch versions and guidance. Additionally, review CISA's KEV catalog for the full list of CVEs and due dates. Organizations should prioritize patching these vulnerabilities given the active exploitation status.