[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCjrz8XEV7HjgBxOa4T88bumRKPNaeEMYs178dMi0syo":3},{"article":4,"iocs":54,"watch_terms":74,"solutions":75,"lesson":169},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"698d3d34-7ef0-4549-81ba-9f690f9e9400","CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV","cisa-adds-5-actively-exploited-artifactory-screenconnect-and-routeros-flaws-to-k-0ddc7c","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. Details of the vulnerabilities are as follows - CVE-2026-42016 (CVSS score: 8.1) - An incorrect authorization","CISA has added five vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. Attackers are chaining these flaws to gain administrative control, deploy backdoors, and distribute malware. Federal agencies are mandated to patch these vulnerabilities by specific deadlines.","CISA adds 5 actively exploited vulnerabilities in Artifactory, ScreenConnect, and RouterOS to its KEV catalog.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcisa-adds-5-actively-exploited.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhva55LDIsAmtR2cRnUJw2XZ3Rvo4YhdJe39cfng8EZ1oHjLevxwRcYoFdg-ydI2I7fdt9OxGj7aMcaHMekZmy9hwSlopIZ4_KQgRnmiSy0OfGh8zO26StiEeOsHaQ4fYed0dbEUCUcz4gJM9Lu6Wt7m-ppDmI7iMl52-cRfQfsu9d90Sp2ncuvbVpAPupe\u002Fs1600\u002Fjj.jpg","2026-09-12T15:54:45+00:00","2026-09-12T18:00:16.987472+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"JFrog Artifactory","product",{"name":21,"type":19},"ConnectWise ScreenConnect",{"name":23,"type":19},"MikroTik RouterOS",{"name":25,"type":26},"JFrog","vendor",{"name":28,"type":26},"ConnectWise",{"name":30,"type":26},"MikroTik","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,65,68,71],{"type":56,"value":57,"context":58},"cve","CVE-2026-42016","JFrog Artifactory incorrect authorization vulnerability",{"type":56,"value":60,"context":61},"CVE-2026-42018","JFrog Artifactory improper authentication vulnerability",{"type":56,"value":63,"context":64},"CVE-2026-84869","ConnectWise ScreenConnect improper privilege management and missing authorization vulnerability",{"type":56,"value":66,"context":67},"CVE-2026-67277","MikroTik RouterOS missing authentication for critical function vulnerability",{"type":56,"value":69,"context":70},"CVE-2026-86060","MikroTik RouterOS improper neutralization of argument delimiters in a command vulnerability",{"type":56,"value":72,"context":73},"CVE-2026-82329","Previously added Artifactory vulnerability used in chaining attacks",[28,25,30],{"controls":76,"vendors":163},[77,106,135],{"slug":78,"name":79,"problem":80,"products":81},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":107,"name":108,"problem":109,"products":110},"patch-management","Automated patch management","Known holes get closed in days, not months.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":53,"name":136,"problem":137,"products":138},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[139,147,155],{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[164],{"slug":165,"name":25,"logo_path":166,"roles":167},"jfrog","\u002Fvendor-logos\u002Fjfrog.png",[168],"affected",{"slug":170,"title":171,"body":172,"framework_refs":173,"framework_notes":184},"chained-exploits-in-artifactory-screenconnect-routeros-highlight-patch-urgency","Chained Exploits in Artifactory, ScreenConnect & RouterOS Highlight Patch Urgency","Attackers are actively chaining known vulnerabilities across JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to escalate privileges, install backdoors, and distribute malware — all using flaws that have publicly available patches. CISA's addition of these CVEs to the KEV catalog signals that exploitation is widespread and not merely theoretical. The core failure is the gap between vulnerability disclosure and organizational patching, leaving attackers a wide window to exploit known weaknesses. Federal agencies face mandated remediation deadlines, but private sector organizations without such mandates are equally at risk if they lack a structured patch prioritization process.",[174,175,176,177,178,179,180,181,182,183],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 CM-8: System Component Inventory","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF RS.MI-3: Newly Identified Vulnerabilities Mitigated","BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities (CISA Binding Operational Directive)","ITIL Change Management: Emergency Change Procedures",{}]