CISA Expands Known Exploited Vulnerabilities Catalog with Urgent Alerts for JFrog Artifactory ConnectWise ScreenConnect and MikroTik RouterOS

The United States Cybersecurity and Infrastructure Security Agency (CISA) has significantly expanded its Known Exploited Vulnerabilities (KEV) catalog this week, issuing a series of urgent directives concerning five high-severity security flaws actively being leveraged by malicious actors. These vulnerabilities, which impact enterprise-grade software and networking infrastructure, have been identified as critical vectors for unauthorized system access, data exfiltration, and the establishment of persistent, long-term backdoors. As of September 12, 2026, the agency has mandated strict remediation timelines for Federal Civilian Executive Branch (FCEB) agencies, reflecting the severity of the threat landscape currently targeting self-hosted environments and remote management tools.

The Scope of the Threat Landscape

The recent additions to the KEV catalog underscore a troubling trend in cyber espionage and criminal operations: the modular chaining of vulnerabilities. Rather than relying on a single entry point, threat actors are increasingly stitching together multiple exploits to navigate complex enterprise security architectures. The latest wave of activity centers on three distinct product suites—JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS—each representing a vital component of the modern software supply chain and network infrastructure.

By targeting these specific technologies, attackers are effectively hitting the "connective tissue" of corporate IT environments. JFrog Artifactory, as a central repository for software binaries and artifacts, is a high-value target for supply chain poisoning. ConnectWise ScreenConnect provides administrative remote access, making it a gateway for lateral movement. Meanwhile, MikroTik RouterOS serves as the foundation for network routing, meaning a compromise there grants attackers a vantage point to intercept and manipulate traffic across entire corporate or ISP networks.

Chronology of Active Exploitation

The timeline of these events reveals a rapid escalation in malicious activity throughout late August and early September 2026. The intelligence community and private sector security firms began documenting these anomalous patterns in mid-August.

• August 15, 2026: Initial reports emerge of unauthorized activity surrounding self-hosted JFrog Artifactory instances. Researchers begin identifying a pattern of chained exploitation involving multiple vulnerabilities.
• August 28, 2026: Security analysts document the first instances of "MikroTrick," an exploit chain targeting MikroTik routers that bypasses authentication mechanisms.
• September 8, 2026: ConnectWise releases a formal security bulletin regarding a client-side vulnerability in its ScreenConnect product, following reports of weaponized remote sessions.
• September 10, 2026: CISA adds two vulnerabilities impacting MikroTik RouterOS to the KEV catalog, citing evidence of widespread exploitation by unknown threat actors.
• September 11, 2026: CISA expands the catalog further, adding three additional vulnerabilities impacting Artifactory and ScreenConnect.
• September 13, 2026: The mandated patching deadline for federal agencies regarding the MikroTik vulnerabilities.

Technical Analysis of the Exploitation Vectors

The JFrog Artifactory Exploit Chain

The most sophisticated of the recent campaigns involves the chaining of multiple flaws in JFrog Artifactory, headlined by the critical CVE-2026-82329, which carries a maximum CVSS score of 9.8. According to telemetry provided by security firm Wiz, attackers are systematically leveraging these bugs to perform a full-stack takeover. The exploitation process typically involves bypassing authentication protocols to gain administrative privileges. Once inside, the threat actors deploy malicious Groovy scripts—a capability inherent to the platform—to execute arbitrary code.

The objective of this activity appears to be twofold: first, the installation of Rust-based backdoors that allow for persistent access even if the initial vulnerability is patched; and second, the creation of administrative "ghost" accounts. These accounts serve as a secondary persistence mechanism, enabling the attackers to maintain access while evading standard auditing logs.

The ScreenConnect "Condition" Abuse

While the vulnerabilities impacting JFrog are server-side, the issue identified in ConnectWise ScreenConnect is a client-side "condition." As noted by Huntress, this flaw allows for the unauthorized transfer and execution of files during a remote session without requiring explicit host confirmation. This is particularly dangerous in managed service provider (MSP) environments, where a technician might connect to a client machine, and an attacker, having intercepted the session or leveraged the vulnerability, triggers a malicious VBScript payload. The vulnerability enables elevated execution, meaning that if the technician’s session has administrative rights, the malicious payload inherits those same permissions, effectively granting the attacker full control over the host system.

The MikroTrick Exploit

CERT Polska has been instrumental in identifying the "MikroTrick" exploit chain. By targeting CVE-2026-67277 and CVE-2026-86060, attackers are able to bypass the authentication requirements of MikroTik RouterOS. This allows for remote, unauthenticated access to the underlying operating system of the router. Once control is established, attackers can manipulate routing tables, intercept unencrypted traffic, or use the device as a node in a broader botnet. The ease with which these devices can be compromised highlights the ongoing struggle to secure edge-of-network hardware that is often left unpatched or misconfigured by enterprise administrators.

Implications for Corporate Security

The inclusion of these vulnerabilities in CISA’s KEV catalog serves as a formal notification to the private sector that the risk threshold has been crossed. For organizations utilizing these tools, the implications are profound. The primary concern is not merely the potential for data loss, but the long-term presence of "sleeper" backdoors.

Industry analysts emphasize that simply applying the vendor-supplied patches may be insufficient if the environment has already been compromised. Organizations are now being advised to conduct thorough forensic audits to ensure that no unauthorized administrative accounts have been created and that no persistent backdoors (like the aforementioned Rust-based implants) have been installed.

Furthermore, the targeting of supply chain tools like Artifactory suggests that attackers are increasingly looking for ways to compromise software before it reaches the end user. If a build server is compromised, the integrity of every piece of software built and distributed from that server is rendered suspect.

Official Responses and Remediation Mandates

CISA has established a tiered approach for federal agencies to address these threats. The urgency is dictated by the level of risk to the federal enterprise:

1. MikroTik RouterOS: Due to the risk of network-wide interception, federal agencies are required to remediate these vulnerabilities by September 13, 2026.
2. ConnectWise ScreenConnect: Recognizing the danger of lateral movement via remote management tools, the deadline is set for September 14, 2026.
3. JFrog Artifactory: Due to the complexity of the exploit chain and the deep-level access required to remediate persistent backdoors, the deadline is extended to September 25, 2026.

While these deadlines apply specifically to the FCEB, CISA strongly urges all private-sector organizations to adopt these timelines as a benchmark for their own security operations. Vendors including JFrog, ConnectWise, and MikroTik have released security patches and technical guidance, and users are encouraged to consult these resources immediately to verify their system versions.

Future Outlook and Conclusion

The events of September 2026 serve as a stark reminder of the "cat-and-mouse" game that defines modern cybersecurity. As defensive measures improve, so too do the tactics of threat actors, who are increasingly favoring the automation of exploit chains. The ability to chain vulnerabilities—turning minor bugs into a catastrophic breach—requires a shift in how organizations prioritize patch management.

The focus can no longer be limited to "patching the criticals." Instead, organizations must implement a defense-in-depth strategy that includes robust endpoint detection and response (EDR) to identify the "post-exploitation" behavior—such as the creation of unauthorized accounts or the execution of unusual scripts—that persists even after a patch is applied. As CISA continues to update the KEV catalog, the cybersecurity community must remain vigilant, treating every notification as a signal to not only update software but to hunt for indicators of compromise that may already be embedded within their infrastructure.

Ultimately, the security of the digital ecosystem relies on the timely cooperation between software vendors, security researchers, and government oversight bodies. The proactive identification and cataloging of these threats by CISA provide a vital framework, but the responsibility for maintaining the integrity of the network ultimately rests with the organizations that operate these essential tools.