Security1 publisher2 min readPublished
CISA sets a September 13 deadline for the MikroTrick RouterOS chain
Federal agencies now have three separate patch deadlines inside twelve days. The lowest-scoring pair of the five flaws added to KEV is the one with a documented 24-day intrusion campaign behind it.
The Watch · Security desk
What happened
- CISA added five flaws in JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to the Known Exploited Vulnerabilities catalog after reports of active exploitation in the wild.
- Attackers chained the two Artifactory bugs with CVE-2026-82329 to take administrator control of self-hosted servers and deploy backdoors between August 15 and September 8, 2026.
- Federal civilian agencies must patch the RouterOS flaws by September 13, the ScreenConnect flaw by September 14, and the Artifactory flaws by September 25.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure ConnectWise says the ScreenConnect servers are unaffected, so the unit of remediation is every client that answers a remote session.
- decision Upgrading Artifactory does not remove a persistent administrator account, a Groovy plugin or a Rust backdoor, so exposed operators have to choose between hunting and rebuilding.
- constraint Anyone triaging this week by CVSS will schedule the Artifactory pair last. The exploitation evidence supports the opposite order.
- capability The RouterOS entry point needs no credentials, so whether a device is reachable depends on which management services it answers on.
CVE-2026-42018 comes first in the Artifactory sequence. An unauthenticated caller can get back an internal anonymous-user token even when anonymous access is switched off [3]. CVE-2026-42016 then accepts that token, because Artifactory validates the signature and the issuer and not the scope [2]. Add CVE-2026-82329, which scores 9.8 and went into KEV earlier this month, and the three bugs together produce administrator control of a self-hosted server [7].
"Attackers are chaining these vulnerabilities to bypass authentication, escalate privileges, and gain administrative control over vulnerable Artifactory instances," Wiz said [8]. On what came after, Wiz said: "Observed post-exploitation activity includes the creation of persistent administrator accounts, the deployment of malicious Groovy plugins for code execution, and the installation of Rust-based backdoors to establish persistence" [9]. Those three things survive an upgrade. Any instance that was reachable during the 24 days from August 15 to September 8 needs to be checked for them [15].
The Artifactory pair scores 8.1 and 7.5, the two lowest of the five KEV additions [17]. They are also the only ones with an intrusion set that has a start date and an end date [7]. A queue ordered by CVSS puts them behind the 9.9 and the 9.2 [17].
CVE-2026-84869 scores 9.9 and sits in the ScreenConnect client [4]. ConnectWise has called it a "condition" that "may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances", and says ScreenConnect servers are not affected [11]. Huntress said "Under certain circumstances, this could enable files to be transferred to and executed on the Host client system, including through elevated execution actions," and told organizations to update to version 26.6.5 [12]. In the three unrelated incidents Huntress documented, the actors used ScreenConnect to push a malicious VBScript to newly connected systems [10].
On the router side, CVE-2026-67277 requires no authentication and discloses kernel memory through the btest service, with denial of service as the second outcome [5]. CVE-2026-86060 abuses argument delimiters to change the trusted RouterOS policy mask and escalate privileges [6]. CERT Polska said last week that it had seen unknown threat actors use two RouterOS flaws to take control of devices without authentication, and named the chain MikroTrick [13]. That chain carries the earliest of the three deadlines, 12 days ahead of the Artifactory one [16].
Huntress gave 26.6.5 as the ScreenConnect target build [12]. Fixed versions for the RouterOS and Artifactory flaws are not listed in the report.
What to watch
- Whether Huntress's three ScreenConnect incidents get attributed to a single actor or stay unrelated.
- Whether CERT Polska or MikroTik publishes device-level indicators for MikroTrick beyond the two CVE numbers.
- Whether any Artifactory operator reports tampered build artifacts.