Reported by 9 outlets

Timeline

1. original reporting

   ⚠️ CRITICAL: CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV CISA added 5 actively exploited vulnerabil

   threatnoir.com · 30d ago · September 14th, 2026

   ⚠️ CRITICAL: CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV CISA added 5 actively exploited vulnerabil

   via Mastodon https://threatnoir.com/focus

2. update from yazoul.net

   JFrog Artifactory privilege escalation, exploited (CVE-2026-42016)

   yazoul.net · 79d ago · July 27th, 2026

   Advisory dated July 27, 2026 for CVE-2026-42016: self-hosted JFrog Artifactory before 7.133.11 lets a low-privilege user reach administrative control because token validation checks signature and issuer but never the token's scope. The fix is upgrading to 7.133.11; no configuration workaround closes the scope-check gap.

3. update from cert.pl

   Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended

   cert.pl · 39d ago · September 5th, 2026

   CERT Polska's September 5, 2026 disclosure of six RouterOS vulnerabilities, including the two-flaw chain it named MikroTrick, which gives unauthenticated full control of devices with SSH exposed to the internet. Fixes shipped in 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Confirmed attacks date to at least September 2 from 82.192.72.4, with 103.102.31.18 used in exploitation attempts; indicators include the log lines 'login failure for user -2' and 'user added by ssh:-2@', a highly privileged ops account, and the Flagged marker via /system/device-mode/print.

4. update from thehackernews.com

   Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

   thehackernews.com · 38d ago · September 6th, 2026

   September 6, 2026 coverage of CERT Polska's warning with a branch-by-branch fix table: 6.49.21, 7.23.4 (7.23.5 on the long-term channel retains the security fix), 7.24.2 stable, and 7.25beta3. Interim guidance: restrict SSH, WWW/WWW-SSL, and the bandwidth-test service to trusted management networks, avoid RouterOS built-in SSH clients on unpatched devices, check the Flagged marker, and review account-creation logs for ssh:-2@ entries.

5. update from connectwise.com

   ScreenConnect 26.6.5 Security Patch (CVE-2026-84869)

   connectwise.com · 36d ago · September 8th, 2026

   ConnectWise vendor bulletin dated 09/08/2026 for CVE-2026-84869, CVSS 9.9 (CWE-862 missing authorization, CWE-269 improper privilege management). The flaw is client-side: files can be transferred and executed through an active session without authorization or Host confirmation, and ScreenConnect servers are not impacted. Remediation is upgrading on-premise servers to 26.6.5 and then reinstalling host clients and access agents; the interim mitigation is deselecting the TransferFiles permission (TransferFilesInSession in legacy roles) for every role. Cloud instances were already updated.

6. update from huntress.com

   Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

   huntress.com · 35d ago · September 9th, 2026

   Huntress report, last updated September 9, 2026, documenting three unrelated incidents on August 20 and 24 where rogue ScreenConnect clients spawned wscript.exe to run 1.vbs through 4.vbs, staged AES-encrypted payloads fetched from Dropbox, and used modified ScreenConnect clients to push the same scripts to newly connected Host sessions, producing worm-like spread. Persistence used a WindowsServiceHost run key pointing into AppData; a backdoored client used ID 7a4d7d66502d4260. The durable hunt it recommends: ScreenConnect audit log entries RunFiles or RanFiles executed from Process: Guest.

7. update from cisa.gov

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   cisa.gov · 34d ago · September 10th, 2026

   CISA alert of September 10, 2026 (date carried in the alert URL and referenced by The Hacker News on September 12) adding the two MikroTik RouterOS flaws, CVE-2026-67277 and CVE-2026-86060, to the KEV catalog based on evidence of active exploitation. Federal Civilian Executive Branch agencies were required to remediate by September 13, 2026.

8. mentioned by cisa.gov

   CISA Adds Three Known Exploited Vulnerabilities to Catalog

   cisa.gov · 33d ago · September 11th, 2026

9. update from thehackernews.com

   Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

   thehackernews.com · 33d ago · September 11th, 2026

   September 11, 2026 reporting on Wiz's telemetry of in-the-wild exploitation between August 15 and September 8, 2026: CVE-2026-42018 hands an internal anonymous-user token to an unauthenticated caller and CVE-2026-42016 lets it be exchanged for administrator scope, so admin actions log as token:[REDACTED] and some escalations completed in under five minutes. Post-exploitation included persistent administrator accounts, malicious Groovy plugins, and a custom Rust backdoor. The related CVE-2026-82329 (CVSS 9.8) was KEV-listed September 2 after a public exploit appeared September 1; Fastly counted about 406,000 exploitation attempts on September 2 and advises rotating the join key and revoking tokens issued since August 28.

10. mentioned by thehackernews.com

    🤖 CISA adds 5 actively exploited flaws to its KEV catalog, impacting JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS. Inc

    thehackernews.com · 31d ago · September 12th, 2026

11. mentioned by thehackernews.com

    🤖 CISA added 5 actively exploited flaws to KEV: JFrog Artifactory (CVE-2026-42016, CVSS 8.1), ConnectWise ScreenConnect, and MikroTik Router

    thehackernews.com · 30d ago · September 13th, 2026

12. update from cyber.netsecops.io

    📰 CISA adds five actively exploited flaws to its KEV catalog CISA adds 5 actively exploited flaws to KEV catalog affecting JFrog Artifactory

    cyber.netsecops.io · 30d ago · September 13th, 2026

    📰 CISA adds five actively exploited flaws to its KEV catalog CISA adds 5 actively exploited flaws to KEV catalog affecting JFrog Artifactory

    via Mastodon https://cyber.netsecops.io/articles/cisa-adds-five-exploited-flaws-in-artifactory-screenconnect-routeros-to-kev/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

13. mentioned by suriq.io

    🔴 EXPLOITED Self-managed JFrog Artifactory: CISA flagged two more flaws (CVE-2026-42016 + CVE-2026-42018) as exploited. Chained, they turn a

    suriq.io · 30d ago · September 13th, 2026

14. update from www.yazoul.net

    🔵 THREAT INTELLIGENCE CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV Vulnerability | CRITICAL CVEs: CV

    www.yazoul.net · 30d ago · September 13th, 2026

    🔵 THREAT INTELLIGENCE CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV Vulnerability | CRITICAL CVEs: CV

    via Mastodon https://www.yazoul.net/news/article/cisa-adds-5-actively-exploited-artifactory-screenconnect-and-routeros-flaws-to-k

15. mentioned by www.yazoul.net

    🔵 THREAT INTELLIGENCE CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV Vulnerability | CRITICAL CVEs: CV

    www.yazoul.net · 30d ago · September 13th, 2026

16. mentioned by cyber.netsecops.io

    📰 CISA adds five actively exploited flaws to its KEV catalog CISA adds 5 actively exploited flaws to KEV catalog affecting JFrog Artifactory

    cyber.netsecops.io · 29d ago · September 14th, 2026

17. update from threatnoir.com

    ⚠️ CRITICAL: Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX GlassWorm threat actors have d

    threatnoir.com · 9d ago · October 4th, 2026

    ⚠️ CRITICAL: Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX GlassWorm threat actors have d

    via Mastodon https://threatnoir.com/focus