CISA adds 4 known exploited vulnerabilities to catalog September 11 2026

CISA's September 11 update put four actively exploited bugs in the KEV catalog: CVE-2026-84869 in ConnectWise ScreenConnect, CVE-2026-42016 and CVE-2026-42018 in JFrog Artifactory, and CVE-2026-85706 in GitLab CE/EE, the last the subject of CISA's same-day alert. None is a zero day. ConnectWise shipped ScreenConnect 26.6.5 on September 8 with a Priority 1 rating and a 9.9 score for a missing authorization flaw that lets files be transferred and executed through an active remote session without host confirmation. GitLab fixed the commits API path traversal on September 10 in 19.3.2, 19.2.6 and 19.1.8, an unauthenticated arbitrary file read scored CVSS 10.0. JFrog's fixes are far older: CVE-2026-42016, a token scope validation failure in self-hosted Artifactory, was published July 27 with 7.133.11 as the fix, and CVE-2026-42018, which hands an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, followed on August 12.

The common thread is not the bug class, it is the asset class: an artifact registry, source code hosting, and a remote access console, the three systems that sit between an attacker and every endpoint and build an estate produces. A GitLab read primitive is worse than a directory listing, because GitLab's own detection guidance treats reading gitlab.yml, the instance configuration file, as the exploitation signature, which points attackers straight at stored secrets and CI credentials. Chained with the Artifactory token bug, a reader becomes an admin of the registry that serves artifacts to production. The ScreenConnect and GitLab entries both carry CISA's forensic triage flag and the same September 14 federal due date, the directive's signal that pre-patch compromise checks are warranted, and for MSP-managed estates a file transfer and execution primitive inside a trusted technician session is the shortest path from one customer to the rest. The exploitation evidence CISA acted on accumulated while fixes sat available, up to six weeks in the Artifactory case, which is the part of this batch a defender should sit with.

ScreenConnect on-prem operators upgrade to 26.6.5, reachable from 25.4 or later, deselect the TransferFiles permission on every role under Administration > Security > Roles as the interim mitigation if patching must wait, and after patching reinstall host clients, update access agents, review users, reset passwords, and enforce MFA. GitLab self-managed installs go to 19.3.2, 19.2.6 or 19.1.8 immediately, with 19.0.9 and 18.11.12 backports available since September 23, and hunt using GitLab's three published detections: the gitlab.yml read, the metadata.path parameter variant, and the path enumeration pattern, all against the repository commits API. Artifactory self-hosted needs 7.133.11 or later for the privilege escalation and 7.111.20, 7.117.27, 7.125.19, 7.133.28 or 7.146.8 by branch for the anonymous token bug, and token issuance logs should be audited for admin-scope grants that no one requested. Federal due dates are September 14 for ScreenConnect and GitLab, September 25 for Artifactory.

Two developments would move this assessment. The KEV entries show knownRansomwareCampaignUse as Unknown for all four; a flip to Known, or confirmed in-the-wild use against on-prem ScreenConnect servers, turns patch-now into assume-breach, since the ScreenConnect client flaw works through an already-established session and leaves the server log quiet. For GitLab, public proof of concept or mass scanning of the commits API traversal would make every internet-exposed pre-patch instance an incident on its own, and the CVSS 10.0 unauthenticated rating says that instance population is large.