13 SEP 2026 — CISA added five actively exploited flaws to its Known Exploited Vulnerabilities catalogue on Friday, in JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS. All three products are management infrastructure: the things that build software, reach into other machines, and route traffic.
Two of the three we wrote about within the past week, before the catalogue listed them.
The three products, and what each one is
Artifactory is the artifact repository — the store of binaries an organisation builds and the dependencies it consumes. We covered the chained flaws that mint administrator tokens there yesterday, including the detail that the resulting administrator actions are logged as token:anonymous rather than under a named account.
ScreenConnect is remote access software. Its purpose is to let a support technician reach into another machine and operate it, which means a compromised instance is not a foothold on one server but a route to every endpoint the tool is entitled to touch.
RouterOS runs MikroTik routers, which sit at the network edge in enormous numbers and are frequently operated by organisations with no security function at all. We covered two chained RouterOS flaws last week, where exploitation preceded disclosure.
What a KEV entry actually asserts
The catalogue gets read as a severity list, but it is not one. An entry requires evidence that a flaw is being exploited. That is a claim about attacker behaviour, not about how bad the bug is.
A CVSS score and a KEV entry answer different questions, and both are useful for different decisions. The score estimates how much damage the flaw could do if exploited — you can work through the vector yourself with a CVSS calculator and see which assumptions move it. The catalogue says somebody is already doing it.
A moderate-scoring flaw under active exploitation outranks a critical one nobody has touched, and it is the second question that should drive this week's patching order.
The pattern is the product category
Five entries, three products, and every one of them manages something else.
That is not a coincidence of one Friday's listings. It is the same shape we have been recording all quarter in software at the internet-facing edge: a build system, a remote-access console and a router are each reachable from outside and trusted from inside, and each one grants authority over other machines rather than merely access to itself.
The economics follow. Compromising a workstation gets an attacker one workstation. Compromising the tool that administers workstations gets them everything that tool can reach.
ScreenConnect is the one to look at first
Of the three, remote-access software is the category where a compromise travels furthest, and it is the one least likely to be inventoried.
Artifactory and RouterOS are owned by somebody. A platform team runs the build system; a network team runs the routers. Remote-access tooling is frequently installed by whoever needed to support a machine, sometimes years ago, sometimes by a contractor, and it keeps working long after the reason for it ends.
What makes that dangerous here is the tool's design rather than any flaw in it. ScreenConnect exists to grant one operator control of another machine, so a compromised server does not need to escalate anywhere — it already holds the authority to do what it does, against every endpoint still enrolled.
The inventory question is not whether you patched ScreenConnect, but whether you know every instance you are running and every endpoint each one can still reach.
Why the federal deadline matters to everyone else
A KEV entry obliges United States federal civilian agencies to patch by a stated date. Nothing about it binds a company in Singapore or Jakarta.
Use it anyway, as a filter rather than an instruction. The catalogue is the most reliable free signal available of which flaws are being used in the wild, and its value to an organisation with no threat-intelligence budget is that somebody else has done the triage. Most listings will name products you do not run. The five entries this week might reduce to one or two you need to act on.
The exception worth flagging is RouterOS. MikroTik hardware is widely deployed across this region precisely because it is inexpensive and capable, which also means a large share of it sits in small businesses and regional ISPs where nobody is reading CISA advisories at all.
What to do
Check whether you run any of the three. Your platform team can answer for Artifactory and ScreenConnect; RouterOS may be harder to inventory.
For Artifactory specifically, patching is not sufficient on its own — the administrator accounts created through the token chain survive the upgrade, and the plugins installed through it are legitimate features. Audit both.
And treat a KEV listing as a floor on urgency rather than a ceiling. The catalogue records exploitation somebody observed and reported, which is a lagging indicator by construction.
View author profile → · Editorial policy
