CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including flaws in JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. Attackers are chaining CVE-2026-42016 and CVE-2026-42018 in Artifactory with CVE-2026-82329 to bypass authentication, escalate privileges, and gain administrative control, enabling deployment of backdoors and malicious Groovy plugins. The ScreenConnect vulnerability CVE-2026-84869 has been exploited to execute unauthorized file transfers and run malicious VBScript payloads during active remote sessions, while two MikroTik RouterOS flaws, CVE-2026-67277 and CVE-2026-86060, are being exploited in an attack chain dubbed 'MikroTrick' to achieve kernel memory disclosure, denial-of-service, and privilege escalation without authentication.

AI-extracted · verify before operational use