CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV CISA将5个被主动利用的Artifactory、ScreenConnect和RouterOS漏洞加入KEV目录

TL;DR

• CISA added five actively exploited vulnerabilities to its KEV catalog affecting JFrog Artifactory (2 flaws), ConnectWise ScreenConnect (1 flaw), and MikroTik RouterOS (2 flaws)
• Attackers are chaining Artifactory CVE-2026-42016 and CVE-2026-42018 with CVE-2026-82329 to gain admin control, deploy malicious Groovy plugins, and install Rust-based backdoors
• ScreenConnect CVE-2026-84869 (CVSS 9.9) enables unauthorized file transfer and execution through active remote sessions, linked to VBScript payload distribution
• MikroTik RouterOS flaws CVE-2026-67277 and CVE-2026-86060 form the "MikroTrick" exploit chain allowing unauthenticated device takeover and privilege escalation
• Federal agencies face patch deadlines ranging from September 13–25, 2026 depending on the vulnerability

Why It Matters

This is a critical update for any organization relying on JFrog Artifactory for artifact management, ConnectWise ScreenConnect for remote support, or MikroTik RouterOS for network infrastructure. The active exploitation in the wild—particularly the chaining of multiple Artifactory vulnerabilities to deploy persistent backdoors—demonstrates how quickly threat actors can combine flaws to achieve full system compromise. Security teams must treat these as urgent patching priorities, especially given the tight federal deadlines.

Technical Details

• CVE-2026-42016 (CVSS 8.1): Incorrect authorization in JFrog Artifactory where token validation checks signature/issuer but not token scope, enabling privilege escalation
• CVE-2026-42018 (CVSS 7.5): Improper authentication in Artifactory that returns an internal anonymous-user token to unauthenticated callers even when anonymous access is disabled, risking sensitive resource exposure
• CVE-2026-84869 (CVSS 9.9): Improper privilege management in ConnectWise ScreenConnect client (not server) allowing file transfer and execution through active remote sessions without authorization or host confirmation; Huntress linked it to VBScript payload delivery
• CVE-2026-67277 (CVSS 8.8): Missing authentication for a critical function in MikroTik RouterOS btest service, enabling kernel memory disclosure and denial-of-service
• CVE-2026-86060 (CVSS 9.2): Improper neutralization of argument delimiters in RouterOS commands, allowing attackers to modify the trusted policy mask and escalate privileges; combined with CVE-2026-67277 forms the "MikroTrick" chain
• Post-exploitation activity includes persistent admin account creation, malicious Groovy plugin deployment, and Rust-based backdoor installation on compromised Artifactory instances

Industry Insight

• Organizations should immediately prioritize patching these vulnerabilities, especially self-hosted Artifactory instances which are being actively chained for full compromise; verify patch levels across all ScreenConnect host clients and MikroTik router deployments
• The MikroTrick exploit chain highlights the growing trend of unauthenticated remote code execution on network infrastructure devices—network segmentation and zero-trust principles should be reinforced for critical routing equipment
• The tight federal patch deadlines (September 13–25) signal the severity; enterprises should adopt similar urgency timelines and consider temporary compensating controls such as network isolation for unpatched systems

TL;DR

• CISA将5个活跃利用漏洞加入KEV目录，涉及JFrog Artifactory（2个）、ConnectWise ScreenConnect（1个）和MikroTik RouterOS（2个）
• 攻击者链式利用Artifactory漏洞获取管理员权限，部署恶意Groovy插件和Rust后门，创建持久化访问
• ScreenConnect漏洞（CVSS 9.9）允许无授权文件传输和执行，已关联VBScript恶意载荷分发攻击
• MikroTik RouterOS漏洞链被命名为"MikroTrick"，可无认证获取设备控制权，导致内核内存泄露和权限提升
• 联邦机构需在9月13日-25日期间完成相应补丁更新

为什么值得看

本文揭示了当前活跃利用的高危漏洞及其实际攻击模式，对IT安全从业者和企业运维团队具有重要参考价值。了解攻击者的链式利用策略和持久化手段，有助于企业制定针对性的防御和应急响应方案。

技术解析

JFrog Artifactory存在两个关键漏洞：CVE-2026-42016（CVSS 8.1）为权限提升漏洞，因验证逻辑缺陷导致；CVE-2026-42018（CVSS 7.5）为认证缺陷，未认证用户可获取匿名令牌。攻击者链式利用这两个漏洞结合CVE-2026-82329（CVSS 9.8），已观察到创建持久管理员账户、部署恶意Groovy插件和Rust后门的完整攻击链。

ConnectWise ScreenConnect的CVE-2026-84869（CVSS 9.9）存在严重权限管理缺陷，攻击者可在无授权和主机确认情况下通过活跃远程会话传输文件和执行操作。该漏洞已被Huntress关联到三起独立事件，攻击者利用其分发VBScript恶意载荷。

MikroTik RouterOS两个漏洞CVE-2026-67277（CVSS 8.8）和CVE-2026-86060（CVSS 9.2）分别涉及btest服务认证缺失和命令注入，可导致内核内存泄露、拒绝服务及权限提升。CERT Polska将其命名为"MikroTrick"攻击链。

联邦机构补丁截止日期：RouterOS漏洞9月13日、ScreenConnect漏洞9月14日、Artifactory漏洞9月25日。

行业启示

攻击者正采用链式利用策略，通过组合多个漏洞实现从认证绕过到权限提升到持久化的完整攻击链，企业需建立更完善的漏洞关联分析和应急响应机制。

远程管理工具和CI/CD平台已成为重点攻击目标，建议优先更新这些关键组件并加强监控，特别是涉及文件传输和执行功能的场景。