Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. Details of the vulnerabilities are as follows - CVE-2026-42016 (CVSS score: 8.1) - An incorrect authorization
Analysis Summary
# Vulnerability: Multiple Actively Exploited Flaws in JFrog, ConnectWise, and MikroTik
## CVE Details
- **CVE ID:** CVE-2026-42016, CVE-2026-42018, CVE-2026-84869, CVE-2026-67277, CVE-2026-86060
- **CVSS Scores:**
- CVE-2026-84869: 9.9 (Critical)
- CVE-2026-86060: 9.2 (Critical)
- CVE-2026-67277: 8.8 (High)
- CVE-2026-42016: 8.1 (High)
- CVE-2026-42018: 7.5 (High)
- **CWE:** Incorrect Authorization, Improper Authentication, Improper Privilege Management, Command Injection.
## Affected Systems
- **Products:**
- JFrog Artifactory (Self-hosted instances)
- ConnectWise ScreenConnect (Client-side)
- MikroTik RouterOS
- **Versions:**
- ScreenConnect: Versions prior to 26.6.5 are vulnerable.
- MikroTik RouterOS: Specific versions impacting the `btest` service and policy masking.
- **Configurations:**
- Artifactory: Vulnerable when anonymous access is disabled (CVE-2026-42018) or via token validation flaws (CVE-2026-42016).
- RouterOS: Attackers exploit the `btest` service.
## Vulnerability Description
- **JFrog Artifactory:** Flaws involve incorrect authorization where token signatures/issuers are validated but scopes are not (CVE-2026-42016), and the leakage of internal anonymous tokens to unauthenticated users (CVE-2026-42018).
- **ConnectWise ScreenConnect:** A flaw in the client allowing file transfer and execution during an active session without host confirmation or authorization.
- **MikroTik RouterOS:** One flaw allows kernel memory disclosure and DoS in the `btest` service (CVE-2026-67277), while the other allows neutralising argument delimiters to escalate privileges by changing the policy mask (CVE-2026-86060).
## Exploitation
- **Status:** Exploited in the wild (All added to CISA KEV catalog).
- **Complexity:** Low (Based on reports of automated chaining and "MikroTrick" exploit chains).
- **Attack Vector:** Network.
- **Note:** JFrog flaws are being chained with CVE-2026-82329 to deploy Rust-based backdoors and Groovy plugins.
## Impact
- **Confidentiality:** High (Internal tokens leaked, kernel memory disclosure).
- **Integrity:** High (Unauthorized file execution, privilege escalation to Admin).
- **Availability:** High (Denial-of-Service in RouterOS).
## Remediation
### Patches
- **ConnectWise ScreenConnect:** Update to version **26.6.5** or later.
- **JFrog Artifactory:** Apply vendor-provided patches for self-hosted instances immediately.
- **MikroTik RouterOS:** Update to the latest stable firmware version to mitigate "MikroTrick" chains.
### Workarounds
- Disable the `btest` service on MikroTik routers if not required.
- Enforce strict firewall rules to limit access to Artifactory management interfaces.
## Detection
- **Indicators of Compromise:**
- Presence of unexpected `.groovy` plugins in Artifactory.
- Deployment of Rust-based binaries/backdoors.
- Unauthorized VBScript payloads on ScreenConnect host systems.
- Creation of persistent administrator accounts.
- **Detection methods:** Monitor system logs for unauthorized "anonymous-user" token requests and unusual RouterOS policy mask changes.
## References
- CISA KEV Catalog: hxxps://www.cisa[.]gov/known-exploited-vulnerabilities-catalog
- ConnectWise Security Bulletin: hxxps://www.connectwise[.]com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin
- Huntress Analysis: hxxps://www.huntress[.]com/blog/rogue-screenconnect-installations
- The Hacker News Report: hxxps://thehackernews[.]com/2026/09/cisa-adds-5-actively-exploited.html