CISA KEV Flags Exploited Artifactory, ScreenConnect and RouterOS Vulnerabilities

CISA recently added five actively exploited Artifactory, ScreenConnect and RouterOS vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The flaws affect JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS.

However, the five flaws expose different security boundaries. The Artifactory vulnerabilities can be chained from unauthenticated access toward administrative control. The ScreenConnect flaw affects file transfer and execution during active remote sessions. Meanwhile, the RouterOS vulnerabilities affect SSH privilege handling and the bandwidth-test service.

For security teams, this is not one patching problem. Each vulnerability requires remediation and investigation at its respective application, endpoint or network layer.

Five Artifactory, ScreenConnect and RouterOS Vulnerabilities in CISA KEV

The vulnerabilities affect software repositories, remote-support endpoints and network infrastructure.

CISA’s KEV designation establishes evidence of active exploitation. However, it does not mean every publicly documented technique was used in every observed attack.

The remediation dates apply to U.S. Federal Civilian Executive Branch agencies. Private-sector organizations can use KEV inclusion as a prioritization signal alongside their own exposure and risk assessments.

CVE-2026-42016 and CVE-2026-42018 are actively exploited JFrog Artifactory vulnerabilities that attackers have chained toward administrative control. CVE-2026-84869 affects ScreenConnect clients before 26.6.5, while CVE-2026-67277 and CVE-2026-86060 affect separate MikroTik RouterOS functions.

How Artifactory Vulnerabilities CVE-2026-42016 and CVE-2026-42018 Lead to Admin Access

CVE-2026-42018 can return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled.

CVE-2026-42016 is a privilege-escalation flaw in which Artifactory validates a token’s signature and issuer without correctly enforcing its scope.

Neither issue independently provides the complete unauthenticated-to-administrator path.

Researchers reported attackers chaining the vulnerabilities between August 15 and September 8, 2026. An unauthenticated request first obtained an internal anonymous-user JWT through CVE-2026-42018. Attackers then exploited CVE-2026-42016 to obtain a token with administrator scope.

Across compromised Artifactory instances, Wiz observed post-exploitation activity that included persistent administrator accounts, malicious Groovy plugins and custom Rust backdoors with command-and-control capabilities. Wiz notes that no single actor performed every documented action.

The compromise also creates software supply-chain risk because Artifactory repositories store and distribute artifacts used in development and deployment workflows.

JFrog lists multiple fixed releases for CVE-2026-42018 across supported branches. CVE-2026-42016 affects self-hosted Artifactory versions before 7.133.11. Therefore, administrators should identify their deployed branch and apply the corresponding vendor-supported update.

How ScreenConnect Vulnerability CVE-2026-84869 Enables File Transfer and Execution

CVE-2026-84869 affects ScreenConnect clients before version 26.6.5. In certain circumstances, the flaw may let an attacker transfer and execute files through an active remote session without authorization or Host confirmation. ConnectWise states that the flaw does not affect ScreenConnect servers.

ConnectWise states that Cloud deployments have been updated automatically. Cloud customers should reinstall Host clients and update Access agents. On-premises customers should upgrade the ScreenConnect server to version 26.6.5, then reinstall Host clients and update Access agents.

Security teams should also investigate suspicious endpoint activity instead of treating an infrastructure update alone as evidence that previously exposed endpoints are clean.

Unexpected file transfers, process execution or remote-access activity deserve additional review where ScreenConnect was exposed during the relevant period.

How RouterOS Vulnerabilities CVE-2026-67277 and CVE-2026-86060 Differ

The two RouterOS vulnerabilities in the CISA KEV update affect different services and should not be treated as one exploit chain.

CVE-2026-86060 affects the RouterOS SSH login mechanism. A crafted username can manipulate session privileges, resulting in full administrative privileges.

However, CVE-2026-86060 is only one component of the documented MikroTrick takeover chain. CERT Polska observed attackers chaining it with CVE-2026-67276 to gain unauthenticated administrative control over RouterOS devices with SSH exposed to public networks.

CVE-2026-67277 is different.

It affects RouterOS’s bandwidth-test service. An unauthenticated client can reach a state that should require authentication. Additional packet-handling weaknesses can then expose kernel memory or trigger a remote denial of service and system restart.

Therefore, CVE-2026-67277 should not be described as the first stage of the confirmed MikroTrick takeover chain.

MikroTik released fixes in RouterOS 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21. The vendor recommends preventing SSH access from untrusted networks.

After upgrading, administrators should review RouterOS logs for compromise indications and inspect the configuration for unknown scripts, users or other unrecognized changes. MikroTik recommends inspecting the configuration even when RouterOS does not indicate that the device has been flagged.

How Should Enterprises Respond to These CISA KEV Vulnerabilities?

Enterprises should treat these Artifactory, ScreenConnect and RouterOS vulnerabilities as three separate remediation and investigation workflows.

1. Artifactory: identify affected self-hosted deployments and apply the fixed release for the deployed branch. Review administrator accounts, plugins and other unexpected changes.
2. ScreenConnect: upgrade affected installations to version 26.6.5 or later. Follow ConnectWise guidance for Host clients and Access agents. Investigate unexpected file transfers, process execution and remote-access activity.
3. RouterOS: install an applicable fixed release, including RouterOS 7.25 beta 3, 7.24.2, 7.23.4 or 6.49.21. Prevent SSH access from untrusted networks, review available compromise indications and inspect the configuration for unauthorized changes.

Patching closes the documented vulnerability. It does not establish whether exploitation occurred before remediation.

That distinction matters most for systems exposed during a known exploitation window.

Where Hexnode Fits Into Endpoint Remediation and Investigation

The most direct Hexnode connection exists at the managed endpoint layer. Hexnode complements vendor remediation rather than replacing application- or network-level fixes.

Hexnode UEM can support patch and compliance workflows, while Hexnode XDR can support threat hunting, investigation and response.

Track Endpoint Patch and Compliance Posture with Hexnode UEM

Hexnode UEM provides advanced patch-management workflows for supported Windows and macOS endpoints. Administrators can manage OS updates on both platforms, while supported application-patching capabilities vary by platform and patch workflow.

For this incident, Hexnode UEM is most relevant to patch management, device inventory and compliance workflows on managed endpoints.

Hexnode UEM device and compliance reports can help administrators identify managed devices and review their compliance status.

If the required ScreenConnect client package is available in a format supported by Hexnode UEM, IT teams can add the updated enterprise app to the Hexnode app inventory and distribute it to managed endpoints through supported app-deployment workflows. Teams should still follow ConnectWise’s documented remediation procedure for Host clients and Access agents.

However, organizations should follow JFrog, ConnectWise and MikroTik’s documented remediation procedures unless their Hexnode deployment workflow explicitly supports the required update.

Patch management is only one part of post-exploitation response.

Featured resource

Why XDR Is Stronger With UEM

See how integrating endpoint management with XDR can connect proactive device management with threat investigation and response.

Download the whitepaper

Investigate Suspicious ScreenConnect Endpoint Activity with Hexnode XDR

The ScreenConnect vulnerability creates a more direct endpoint-security use case.

Hexnode XDR supports threat hunting through a query engine that helps security teams investigate suspicious endpoint activity.

Documented response actions include Isolate Device, Kill Process, Kill Process Tree and Quarantine File. Analysts can terminate an identified malicious process or use Kill Process Tree to terminate that process and its spawned child processes. This can help contain an execution chain if suspicious activity identified during investigation includes malicious parent-child processes.

These controls do not patch CVE-2026-84869. They also do not establish that Hexnode XDR specifically detects exploitation of this vulnerability.

The RouterOS and Artifactory fixes must likewise occur at their respective network-appliance and application infrastructure layers.

Patch the Vulnerability, Then Investigate the Exposure Window

The Artifactory, ScreenConnect and RouterOS vulnerabilities span three different enterprise attack surfaces.

Artifactory demonstrates how two authorization and authentication weaknesses can be chained toward administrative access. ScreenConnect exposes a security boundary inside trusted remote-support sessions. RouterOS shows how network-management services can expose paths to memory disclosure, disruption or privileged router access.

Enterprises should take two steps: apply each vendor’s remediation and investigate systems exposed before the fix. A successful patch closes the documented flaw. Incident review determines whether attackers got there first.