The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog. These flaws were identified following confirmed reports of active exploitation in the wild. The update was published on September 12, 2026, as part of CISA’s ongoing effort to highlight critical risks requiring immediate patching.
The vulnerabilities include multiple flaws in Artifactory related to authentication bypass and path traversal, which could allow unauthorized access to sensitive repositories. ScreenConnect flaws involve improper input validation leading to remote code execution, while RouterOS issues stem from weaknesses in service handling that enable privilege escalation. All five vulnerabilities have been observed in real-world attacks, prompting CISA to mandate remediation for federal agencies within specified timelines.
Attackers have leveraged the Artifactory vulnerabilities to gain access to internal software repositories, potentially compromising build pipelines and injecting malicious code. In ScreenConnect cases, threat actors have used the flaws to hijack remote sessions and deploy ransomware across networks. MikroTik RouterOS exploits have been used to hijack traffic and maintain persistent access on edge devices, particularly in smaller organizations with limited monitoring.
Organizations using these products must apply the latest patches released by JFrog, ConnectWise, and MikroTik without delay. CISA recommends reviewing network logs for signs of compromise, especially around authentication attempts and unusual administrative actions. Federal civilian agencies are required to remediate the vulnerabilities by the dates specified in the KEV entry, though CISA urges all entities to prioritize fixes regardless of sector.
Why did CISA add these five vulnerabilities to the KEV catalog? CISA added them because there is reliable evidence of active exploitation in the wild, posing a significant risk to federal and private sector networks.
Are these vulnerabilities only dangerous for government agencies? No, while federal agencies must comply with binding directives, the flaws present a serious threat to any organization using the affected software versions.
How can I check if my systems are vulnerable? Review the specific CVE identifiers listed in the KEV entry and verify your software versions against the vendor’s security advisories for patch availability.