CTI · reviewed · 2026-10-04

CISA KEV update: five actively exploited Artifactory, ScreenConnect, and RouterOS flaws added

Full story & timeline

Actors

—

Malware / tools

—

Campaigns

—

CVEs

CVE-2026-42016CVE-2026-42018CVE-2026-84869CVE-2026-67277CVE-2026-86060

Victim sectors

technologyenterprisetelecommunications

Geography

global

MITRE ATT&CK

T1190 Exploit Public-Facing Application Initial Access
T1059 Command and Scripting Interpreter Execution
T1219 Remote Access Tools Command and Control
T1078 Valid Accounts Stealth

Indicators

Observables tied to this case, from the curated feed. raw sidecar

103.102.31.18 ipv4 · active · corroborated
82.192.72.4 ipv4 · active · corroborated

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Rogue ScreenConnect Client Spawning WScript
id: ab957401-34cc-4a45-9817-a68b396e6f72
status: experimental
description: >
  Detects the ScreenConnect worm chain documented by Huntress for CVE-2026-84869:
  a rogue ScreenConnect client spawning wscript.exe or cscript.exe to run staged
  1.vbs through 4.vbs payloads that spread the same scripts to newly connected
  host sessions. The related incidents also used AES-encrypted payloads fetched
  from Dropbox and a WindowsServiceHost run key under AppData; wscript.exe
  children of ScreenConnect.WindowsClient.exe running VBS files are treated as
  compromise indicators until host clients are reinstalled.
references:
  - https://thehackernews.com/2026/09/cisa-adds-5-actively-exploited.html
  - https://cyber.netsecops.io/articles/cisa-adds-five-exploited-flaws-in-artifactory-screenconnect-routeros-to-kev/
author: Tia N. List
date: 2026/10/04
tags:
  - attack.t1190
  - attack.initial-access
  - attack.t1059
  - attack.execution
  - attack.t1219
  - attack.command-and-control
  - attack.t1078
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\ScreenConnect.WindowsClient.exe'
  selection_child:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_script:
    CommandLine|contains:
      - '1.vbs'
      - '2.vbs'
      - '3.vbs'
      - '4.vbs'
  condition: selection_parent and selection_child and selection_script
falsepositives:
  - Administrators legitimately running VBScript through an interactive ScreenConnect session
  - ScreenConnect automation that happens to reference files named 1.vbs through 4.vbs
level: high