{"id":1687,"date":"2026-09-16T15:07:59","date_gmt":"2026-09-16T09:37:59","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1687"},"modified":"2026-09-21T12:14:32","modified_gmt":"2026-09-21T06:44:32","slug":"cisa-kev-artifactory-screenconnect-routeros","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/cisa-kev-artifactory-screenconnect-routeros\/","title":{"rendered":"CISA KEV Flags Exploited Artifactory, ScreenConnect and RouterOS Vulnerabilities"},"content":{"rendered":"

CISA recently added five actively exploited Artifactory, ScreenConnect and RouterOS vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The flaws affect JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS.<\/p>\n

However, the five flaws expose different security boundaries. The Artifactory vulnerabilities can be chained from unauthenticated access toward administrative control. The ScreenConnect flaw affects file transfer and execution during active remote sessions. Meanwhile, the RouterOS vulnerabilities affect SSH privilege handling and the bandwidth-test service.<\/p>\n

For security teams, this is not one patching problem. Each vulnerability requires remediation and investigation at its respective application, endpoint or network layer.<\/p>\n

Five Artifactory, ScreenConnect and RouterOS Vulnerabilities in CISA KEV<\/h2>\n

The vulnerabilities affect software repositories, remote-support endpoints and network infrastructure.<\/p>\n\n\n\n\n\n\n\n\n
CVE<\/span><\/b>\u00a0<\/span><\/td>\nProduct<\/span><\/b>\u00a0<\/span><\/td>\nVulnerability<\/span><\/b>\u00a0<\/span><\/td>\nCVSS<\/span><\/b>\u00a0<\/span><\/td>\nDocumented impact \/ fix<\/span><\/b>\u00a0<\/span><\/td>\nFederal remediation deadline<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
CVE-2026-42016<\/span><\/b>\u00a0<\/span><\/td>\nJFrog\u00a0Artifactory<\/span>\u00a0<\/span><\/td>\nIncorrect authorization<\/span>\u00a0<\/span><\/td>\n8.1<\/span>\u00a0<\/span><\/td>\nToken privilege escalation; upgrade to an applicable fixed Artifactory release<\/span>\u00a0<\/span><\/td>\nSeptember 25, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVE-2026-42018<\/span><\/b>\u00a0<\/span><\/td>\nJFrog\u00a0Artifactory<\/span>\u00a0<\/span><\/td>\nImproper authentication<\/span>\u00a0<\/span><\/td>\n7.5<\/span>\u00a0<\/span><\/td>\nAnonymous-user token exposure; upgrade to an applicable fixed Artifactory release<\/span>\u00a0<\/span><\/td>\nSeptember 25, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVE-2026-84869<\/span><\/b>\u00a0<\/span><\/td>\nConnectWise ScreenConnect<\/span>\u00a0<\/span><\/td>\nImproper privilege management \/ missing authorization<\/span>\u00a0<\/span><\/td>\n9.9, CVSS v3.1<\/span>\u00a0<\/span><\/td>\nUpgrade to ScreenConnect 26.6.5 or later<\/span>\u00a0<\/span><\/td>\nSeptember 14, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVE-2026-67277<\/span><\/b>\u00a0<\/span><\/td>\nMikroTik\u00a0RouterOS<\/span>\u00a0<\/span><\/td>\nMissing authentication \/ bandwidth-test flaw<\/span>\u00a0<\/span><\/td>\n8.8, CVSS v4.0<\/span>\u00a0<\/span><\/td>\nKernel memory disclosure or remote DoS; update RouterOS<\/span>\u00a0<\/span><\/td>\nSeptember 13, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVE-2026-86060<\/span><\/b>\u00a0<\/span><\/td>\nMikroTik\u00a0RouterOS<\/span>\u00a0<\/span><\/td>\nArgument handling in SSH login<\/span>\u00a0<\/span><\/td>\n9.2, CVSS v4.0<\/span>\u00a0<\/span><\/td>\nPrivilege escalation; update RouterOS<\/span>\u00a0<\/span><\/td>\nSeptember 13, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

CISA’s KEV designation establishes evidence of active exploitation. However, it does not mean every publicly documented technique was used in every observed attack.<\/p>\n

The remediation dates apply to U.S. Federal Civilian Executive Branch agencies. Private-sector organizations can use KEV inclusion as a prioritization signal alongside their own exposure and risk assessments.<\/p>\n

CVE-2026-42016<\/a> and CVE-2026-42018<\/a> are actively exploited JFrog Artifactory vulnerabilities that attackers have chained toward administrative control. CVE-2026-84869<\/a> affects ScreenConnect clients before 26.6.5, while CVE-2026-67277<\/a> and CVE-2026-86060<\/a> affect separate MikroTik RouterOS functions.<\/p>\n

How Artifactory Vulnerabilities CVE-2026-42016 and CVE-2026-42018 Lead to Admin Access<\/h2>\n

CVE-2026-42018 can return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled.<\/p>\n

CVE-2026-42016 is a privilege-escalation<\/a> flaw in which Artifactory validates a token’s signature and issuer without correctly enforcing its scope.<\/p>\n

Neither issue independently provides the complete unauthenticated-to-administrator path.<\/p>\n

Researchers reported attackers chaining the vulnerabilities between August 15 and September 8, 2026. An unauthenticated request first obtained an internal anonymous-user JWT through CVE-2026-42018. Attackers then exploited CVE-2026-42016 to obtain a token with administrator scope.<\/p>\n

Across compromised Artifactory instances, Wiz observed post-exploitation activity that included persistent administrator accounts, malicious Groovy plugins and custom Rust backdoors with command-and-control capabilities. Wiz notes that no single actor performed every documented action.<\/p>\n

The compromise also creates software supply-chain risk because Artifactory repositories store and distribute artifacts used in development and deployment workflows.<\/p>\n

JFrog lists multiple fixed releases for CVE-2026-42018 across supported branches. CVE-2026-42016 affects self-hosted Artifactory versions before 7.133.11. Therefore, administrators should identify their deployed branch and apply the corresponding vendor-supported update.<\/p>\n

How ScreenConnect Vulnerability CVE-2026-84869 Enables File Transfer and Execution<\/h2>\n

CVE-2026-84869 affects ScreenConnect clients before version 26.6.5. In certain circumstances, the flaw may let an attacker transfer and execute files through an active remote session without authorization or Host confirmation. ConnectWise states that the flaw does not affect ScreenConnect servers.<\/p>\n

ConnectWise states that Cloud deployments have been updated automatically. Cloud customers should reinstall Host clients and update Access agents. On-premises customers should upgrade the ScreenConnect server to version 26.6.5, then reinstall Host clients and update Access agents.<\/p>\n

Security teams should also investigate suspicious endpoint activity instead of treating an infrastructure update alone as evidence that previously exposed endpoints are clean.<\/p>\n

Unexpected file transfers, process execution or remote-access activity deserve additional review where ScreenConnect was exposed during the relevant period.<\/p>\n

How RouterOS Vulnerabilities CVE-2026-67277 and CVE-2026-86060 Differ<\/h2>\n

The two RouterOS vulnerabilities in the CISA KEV update affect different services and should not be treated as one exploit chain.<\/p>\n

CVE-2026-86060 affects the RouterOS SSH login mechanism. A crafted username can manipulate session privileges, resulting in full administrative privileges.<\/p>\n

However, CVE-2026-86060 is only one component of the documented MikroTrick takeover chain. CERT Polska observed attackers chaining it with CVE-2026-67276 to gain unauthenticated administrative control over RouterOS devices with SSH exposed to public networks.<\/p>\n

CVE-2026-67277 is different.<\/p>\n

It affects RouterOS’s bandwidth-test service. An unauthenticated client can reach a state that should require authentication. Additional packet-handling weaknesses can then expose kernel memory or trigger a remote denial of service and system restart.<\/p>\n

Therefore, CVE-2026-67277 should not be described as the first stage of the confirmed MikroTrick takeover chain.<\/p>\n

MikroTik released fixes in RouterOS 7.25 beta 3, 7.24.2, 7.23.4 and 6.49.21. The vendor recommends preventing SSH access from untrusted networks.<\/p>\n

After upgrading, administrators should review RouterOS logs for compromise indications and inspect the configuration for unknown scripts, users or other unrecognized changes. MikroTik recommends inspecting the configuration even when RouterOS does not indicate that the device has been flagged.<\/p>\n

How Should Enterprises Respond to These CISA KEV Vulnerabilities?<\/h2>\n

Enterprises should treat these Artifactory, ScreenConnect and RouterOS vulnerabilities as three separate remediation and investigation workflows.<\/p>\n

    \n
  1. Artifactory:<\/strong> identify affected self-hosted deployments and apply the fixed release for the deployed branch. Review administrator accounts, plugins and other unexpected changes.<\/li>\n
  2. ScreenConnect:<\/strong> upgrade affected installations to version 26.6.5 or later. Follow ConnectWise guidance for Host clients and Access agents. Investigate unexpected file transfers, process execution and remote-access activity.<\/li>\n
  3. RouterOS:<\/strong> install an applicable fixed release, including RouterOS 7.25 beta 3, 7.24.2, 7.23.4 or 6.49.21. Prevent SSH access from untrusted networks, review available compromise indications and inspect the configuration for unauthorized changes.<\/li>\n<\/ol>\n

    Patching closes the documented vulnerability. It does not establish whether exploitation occurred before remediation.<\/p>\n

    That distinction matters most for systems exposed during a known exploitation window.<\/p>\n

    <\/div>

    IT Admin\u2019s Guide to Patch Management with Hexnode<\/h4>

    Learn how IT teams can identify, deploy, track and manage patches across supported endpoints with Hexnode.<\/p><\/div><\/div><\/div><\/a><\/div><\/div><\/div>\n

    Where Hexnode Fits Into Endpoint Remediation and Investigation<\/h2>\n

    The most direct Hexnode connection exists at the managed endpoint layer. Hexnode complements vendor remediation rather than replacing application- or network-level fixes.<\/p>\n

    Hexnode UEM<\/a> can support patch and compliance workflows, while Hexnode XDR<\/a> can support threat hunting, investigation and response.<\/p>\n

    Track Endpoint Patch and Compliance Posture with Hexnode UEM<\/h3>\n

    Hexnode UEM provides advanced patch-management workflows for supported Windows and macOS endpoints. Administrators can manage OS updates on both platforms, while supported application-patching capabilities vary by platform and patch workflow.<\/p>\n

    For this incident, Hexnode UEM is most relevant to patch management<\/a>, device inventory and compliance workflows on managed endpoints.<\/p>\n

    Hexnode UEM device and compliance reports can help administrators identify managed devices and review their compliance status.<\/p>\n

    If the required ScreenConnect client package is available in a format supported by Hexnode UEM, IT teams can add the updated enterprise app to the Hexnode app inventory and distribute it to managed endpoints through supported app-deployment workflows. Teams should still follow ConnectWise’s documented remediation procedure for Host clients and Access agents.<\/p>\n

    However, organizations should follow JFrog, ConnectWise and MikroTik\u2019s documented remediation procedures unless their Hexnode deployment workflow explicitly supports the required update.<\/p>\n

    Patch management is only one part of post-exploitation response.<\/p>\n

    \n
    \n
    \n
    \n \"Why-XDR-IS-stronger-thumbnail\"\n <\/div>\n <\/div>\n
    \n
    \n Featured resource\n <\/h5>\n

    \n Why XDR Is Stronger With UEM\n <\/h4>\n

    \n See how integrating endpoint management with XDR can connect proactive device management with threat investigation and response.\n <\/p>\n \n Download the whitepaper\n \n \n \n \n <\/g>\n <\/svg>\n\n <\/a>\n <\/div>\n <\/div>\n <\/section>\n

    Investigate Suspicious ScreenConnect Endpoint Activity with Hexnode XDR<\/h3>\n

    The ScreenConnect vulnerability creates a more direct endpoint-security use case.<\/p>\n

    Hexnode XDR supports threat hunting through a query engine that helps security teams investigate suspicious endpoint activity.<\/p>\n

    Documented response actions include Isolate Device, Kill Process, Kill Process Tree and Quarantine File. Analysts can terminate an identified malicious process or use Kill Process Tree to terminate that process and its spawned child processes. This can help contain an execution chain if suspicious activity identified during investigation includes malicious parent-child processes.<\/p>\n

    These controls do not patch CVE-2026-84869. They also do not establish that Hexnode XDR specifically detects exploitation of this vulnerability.<\/p>\n

    The RouterOS and Artifactory fixes must likewise occur at their respective network-appliance and application infrastructure layers.<\/p>\n

    FAQs<\/h2>
    Do CVE-2026-67277 and CVE-2026-86060 form the MikroTrick attack chain?<\/span>\n
    <\/span><\/span><\/div>\n <\/div>

    No. CERT Polska documented the MikroTrick takeover chain using CVE-2026-67276 with CVE-2026-86060. CVE-2026-67277 separately affects the RouterOS bandwidth-test service.<\/p>\n<\/div><\/div><\/div>\n

    Does upgrading to ScreenConnect 26.6.5 require endpoint-side action?<\/span>\n
    <\/span><\/span><\/div>\n <\/div>

    Yes. ConnectWise states that customers should reinstall Host clients and update Access agents. On-premises customers must also upgrade the ScreenConnect server to version 26.6.5.<\/p>\n<\/div><\/div><\/div><\/div><\/div>\n

    Patch the Vulnerability, Then Investigate the Exposure Window<\/h3>\n

    The Artifactory, ScreenConnect and RouterOS vulnerabilities span three different enterprise attack surfaces.<\/p>\n

    Artifactory demonstrates how two authorization and authentication weaknesses can be chained toward administrative access. ScreenConnect exposes a security boundary inside trusted remote-support sessions. RouterOS shows how network-management services can expose paths to memory disclosure, disruption or privileged router access.<\/p>\n

    Enterprises should take two steps: apply each vendor\u2019s remediation and investigate systems exposed before the fix. A successful patch closes the documented flaw. Incident review determines whether attackers got there first.<\/p>\n

    <\/div><\/div>
    Strengthen Endpoint Patch and Compliance Management<\/h5>

    Manage supported endpoint updates, compliance workflows and device visibility with Hexnode UEM.<\/p>