CISA ADDS THREE ACTIVELY EXPLOITED VULNERABILITIES TO KEV CATALOG ACROSS JFROG ARTIFACTORY AND CONNECTWISE SCREENCONNECT

THREAT SUMMARY

Category: Actively Exploited Vulnerabilities / Enterprise Infrastructure / Remote Access Security
Affected Product(s): JFrog Artifactory, ConnectWise ScreenConnect
CVE(s): CVE-2026-42016, CVE-2026-42018, CVE-2026-84869
Primary Risks: Incorrect authorization, improper authentication, improper privilege management, missing authorization controls, unauthorized access, and potential follow-on compromise of affected systems
Threat Status: Active exploitation confirmed by CISA
Affected Environment(s): Enterprise artifact repository infrastructure, software-development environments, remote-access systems, and internet-exposed enterprise services running affected products
Attack Vector(s): Authorization weaknesses, authentication weaknesses, privilege-management failures, and missing access-control enforcement
CISA Action: Three vulnerabilities added to the Known Exploited Vulnerabilities Catalog on September 11, 2026
Required Response: Federal Civilian Executive Branch agencies must apply the risk-based requirements established under Binding Operational Directive 26-04. CISA encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities based on operational risk and exposure.

---

CISA has added three vulnerabilities affecting JFrog Artifactory and ConnectWise ScreenConnect to its Known Exploited Vulnerabilities Catalog after determining that there is evidence of active exploitation.

The September 11 additions involve two vulnerabilities in JFrog Artifactory and one in ConnectWise ScreenConnect:

CVE-2026-42016 — JFrog Artifactory Incorrect Authorization Vulnerability

CVE-2026-42018 — JFrog Artifactory Improper Authentication Vulnerability

CVE-2026-84869 — ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

CISA’s decision to add all three CVEs to the KEV Catalog moves them out of the category of vulnerabilities that organizations can evaluate solely on theoretical severity.

The agency states that each has evidence of active exploitation.

That distinction matters operationally.

A disclosed vulnerability may represent a serious weakness, but KEV status means defenders must account for the fact that malicious cyber actors are already exploiting the flaw in real environments.

CISA also warned that vulnerabilities of these types are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

---

Vulnerability Details

CVE-2026-42016 — JFrog Artifactory Incorrect Authorization Vulnerability

CISA identified CVE-2026-42016 as an actively exploited vulnerability affecting JFrog Artifactory.

The flaw is classified as an incorrect authorization vulnerability.

Authorization controls determine whether a user, account, service, or process is permitted to perform a specific action after access has been established.

When those controls fail, a system may allow actions that should have been blocked by policy or privilege boundaries.

CISA’s September 11 alert does not provide detailed exploitation mechanics, affected version ranges, or specific post-exploitation behavior for CVE-2026-42016.

The key operational fact is that CISA has confirmed evidence of exploitation and has moved the vulnerability into KEV.

Organizations operating Artifactory should therefore treat the vulnerability as an active threat rather than waiting for exploitation to become widespread before responding.

---

CVE-2026-42018 — JFrog Artifactory Improper Authentication Vulnerability

The second Artifactory vulnerability, CVE-2026-42018, is classified by CISA as an improper authentication vulnerability.

Authentication controls are responsible for establishing whether a user, account, or process is permitted to enter a protected system.

Failures at that layer can undermine one of the fundamental security boundaries separating trusted and untrusted access.

CISA has not provided additional technical exploitation details in the September 11 alert, but its placement in KEV establishes that exploitation has been observed.

The presence of two separate actively exploited vulnerabilities affecting the same product deserves particular attention from organizations running JFrog Artifactory.

Defenders should not treat the two CVEs as interchangeable.

One concerns authorization controls and the other concerns authentication, representing separate security boundaries that should be reviewed independently during remediation and compromise assessment.

---

CVE-2026-84869 — ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

CISA also added CVE-2026-84869, affecting ConnectWise ScreenConnect.

The vulnerability is classified as an improper privilege management and missing authorization vulnerability.

Privilege-management controls determine what level of authority a user or process receives after access has been established.

Missing authorization controls can create conditions in which restricted operations are not adequately checked before execution.

Because ScreenConnect is associated with remote-access functionality, organizations should treat authorization and privilege failures affecting these environments as significant.

The September 11 CISA alert does not disclose the precise exploitation path, affected versions, attacker prerequisites, or observed post-compromise behavior.

What CISA does confirm is that the vulnerability has been exploited and now meets the agency’s criteria for inclusion in the KEV Catalog.

---

Operational Impact

The three vulnerabilities affect technologies positioned inside important enterprise functions.

JFrog Artifactory places software-development and artifact-management environments in scope.

ConnectWise ScreenConnect places remote-access and support infrastructure in scope.

The operational concern is not limited to the names of the vulnerability classes.

The significance comes from the combination of enterprise exposure and confirmed exploitation.

Organizations should evaluate:

• Whether affected products are deployed.
• Whether those deployments are exposed to the public internet.
• Whether vulnerable systems provide access to sensitive internal resources.
• Whether administrative, service, or privileged accounts interact with the affected systems.
• Whether systems were exposed before remediation was applied.
• Whether logs or other evidence indicate suspicious access during the exposure window.
• Whether a compromised system could provide a path into additional enterprise infrastructure.

The presence of active exploitation changes the response priority.

A system can be patched and still remain compromised if an attacker gained access before the vulnerability was fixed.

That is why remediation and compromise assessment must be treated as related but separate activities.

---

Federal Response

The September 11 additions fall under Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk.

BOD 26-04 establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies.

The directive reinforces the KEV Catalog as a central mechanism for prioritizing vulnerabilities based on demonstrated exploitation and operational risk.

CISA specifically requires federal agencies to prioritize rapid remediation of high-risk KEV vulnerabilities affecting publicly exposed assets that grant total control of the asset following exploitation.

The directive also establishes expectations for determining whether threat actors may have compromised systems before patches or mitigations were applied.

This is an important distinction in federal vulnerability management.

Installing an update addresses the underlying weakness going forward.

It does not establish whether an attacker was already present before remediation.

For systems that were publicly accessible during a confirmed exploitation period, compromise assessment may be necessary in addition to patching.

---

KEV

CISA’s Known Exploited Vulnerabilities Catalog is intended to distinguish vulnerabilities being used by attackers from the much larger population of disclosed software weaknesses.

For a vulnerability to qualify for potential KEV inclusion, CISA states that it must have:

• A CVE identifier.
• Evidence of exploitation.
• Clear mitigation guidance.

The September 11 update adds three CVEs across two affected products.

That means organizations should not evaluate these vulnerabilities only through routine severity scoring or normal maintenance schedules.

KEV status provides an additional risk signal: exploitation has occurred.

BOD 26-04 applies directly to FCEB agencies, but CISA encourages organizations outside the federal government to adopt risk-based vulnerability management and give KEV-listed vulnerabilities priority.

CISA also continues to accept nominations for exploited vulnerabilities that are not yet included in the catalog.

---

Defensive Guidance

Organizations operating JFrog Artifactory or ConnectWise ScreenConnect should identify affected deployments and determine whether vulnerable systems have been exposed.

Priority actions should include:

• Inventory all JFrog Artifactory and ConnectWise ScreenConnect deployments.
• Determine whether affected systems are publicly accessible.
• Prioritize remediation of CVE-2026-42016, CVE-2026-42018, and CVE-2026-84869.
• Apply vendor-approved updates or mitigations applicable to the affected deployment.
• Review authentication and authorization activity for signs of unauthorized access.
• Inspect administrative and privileged-account activity for unexplained changes.
• Review systems that were internet-facing before remediation for possible compromise.
• Preserve relevant logs before rebuilding or making major changes to systems where intrusion is suspected.
• Rotate credentials, tokens, or privileged access material if compromise is identified.
• Review connected infrastructure for follow-on activity if an affected system was breached.
• Verify that remediation was successfully applied rather than assuming installation completed correctly.
• Continue monitoring KEV updates and vendor security guidance as additional information becomes available.

Organizations should not treat patching as proof that no compromise occurred.

If exploitation happened before remediation, incident-response activity may still be required.

---

30-Day Outlook

The immediate risk surrounding these three vulnerabilities remains elevated because they are now confirmed KEV entries.

Organizations should expect:

• Continued exploitation attempts against systems that remain unremediated.
• Increased scanning for exposed Artifactory and ScreenConnect deployments.
• Greater defender attention to authentication and authorization anomalies.
• Additional vendor or government guidance as exploitation data develops.
• More compromise assessments against systems that were exposed before remediation.
• Potential discovery of persistence or follow-on activity in environments compromised before fixes were applied.
• Increased pressure on organizations that maintain publicly exposed enterprise infrastructure to shorten remediation timelines.

The two JFrog vulnerabilities deserve particular attention because they affect different access-control layers within the same product.

CVE-2026-42016 concerns authorization.

CVE-2026-42018 concerns authentication.

CVE-2026-84869 places privilege management and authorization controls inside ScreenConnect environments under the same active-exploitation warning.

For defenders, the next 30 days should center on exposure identification, remediation validation, log review, and compromise assessment rather than patch deployment alone.

---

TRJ Verdict

The September 11 KEV update is small in number but significant in scope.

Only three vulnerabilities were added, but they affect technologies positioned inside software-development and remote-access environments. The strongest warning is not their vulnerability classification.

It is CISA’s confirmation that all three are being actively exploited.

Two separate JFrog Artifactory vulnerabilities place authentication and authorization controls under pressure within the same product family.

The ConnectWise ScreenConnect vulnerability combines improper privilege management with missing authorization controls inside remote-access infrastructure.

That combination should move these CVEs out of standard maintenance cycles and into immediate risk-based remediation.

Organizations with affected deployments should determine not only whether they are vulnerable, but whether they were exposed long enough for exploitation to have already occurred.

For systems that were accessible before remediation, the question is no longer simply “Have we patched it?”

The more important question is “Was anyone already inside before we did?”

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---