CISA Flags Five Actively Exploited Bugs in Tools Your Business Probably Runs

CISA added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalogue this week. The spread is worth pausing on. The flaws sit in JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS. That’s an artefact registry, a remote-support tool and a router operating system. Three very different products. All under confirmed attack. All added to the same list within 48 hours of each other.

For a UK business, the CISA catalogue is not a legal requirement. It binds US federal agencies to fixed patching deadlines under Binding Operational Directive 26-04. But it answers a more useful question than any severity score alone. Which of the hundreds of vulnerabilities disclosed this month are actually being used against real targets right now? Most just sit in a scanner report, waiting for someone to notice.

The router flaw attackers found first

The MikroTik RouterOS issues carry the earliest deadline on CISA’s list: 13 September. They belong to a wider set of three vulnerabilities. CERT Polska and MikroTik jointly labelled the set “MikroTrick”. One of the three is an SSH authentication bypass, tracked as CVE-2026-67276. It lets an attacker log in as a legitimate user without knowing that user’s private key. RouterOS was checking only part of the RSA public key, not the whole thing.

CERT Polska found this actively exploited vulnerability already being used from at least 2 September. That was three days before MikroTik’s public disclosure. The timing matters. The attackers were ahead of the advisory, not reacting to it. Shadowserver’s scans counted more than 122,500 RouterOS devices with SSH reachable from the internet in a single pass on 5 September. The exposed population is large.

CISA placed two of the three CVEs directly in the KEV catalogue: CVE-2026-86060 and CVE-2026-67277. The first covers privilege escalation through a command-injection flaw in the router’s policy handling. The second is an unauthenticated bandwidth-test service that can leak kernel memory or crash the device outright. MikroTik’s fix spans RouterOS 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. Its advisory has a clear recommendation too: take SSH off the public internet, and use a VPN such as WireGuard for remote admin instead. A patched router with an exposed management port is still a softer target than one with neither problem fixed.

A remote-support tool scored 9.9

ConnectWise ScreenConnect’s flaw, CVE-2026-84869, carries a CVSS score of 9.9. That’s about as severe as the scale allows. The bug sits in the ScreenConnect client, not the server. During an active remote session, files can be transferred to and run on the host machine. Normally a host-confirmation step should block that. Here, it doesn’t. ScreenConnect and tools like it are exactly what IT support desks and managed service providers use to reach client machines. A working exploit hands an attacker a ready-made path from one compromised session into whatever that session could touch.

ConnectWise has shipped version 26.6.5. Cloud-hosted instances were updated automatically. On-premises deployments need a manual upgrade. Until that happens, disabling file-transfer permissions under Administration, Security, Roles removes the specific capability the flaw depends on. This is one of five actively exploited vulnerabilities on this week’s list, and it is the one most likely to touch a small business through its MSP. If your business relies on one, ask a direct question this week: which ScreenConnect build do you run, and have you patched it.

Two routes into an artefact registry

JFrog Artifactory’s pair of bugs is quieter but still earns its place. CVE-2026-42016 is an authorisation flaw. Artifactory checks that an access token’s signature and issuer are valid. It doesn’t check that the token’s scope covers the action requested. That gap opens a route to privilege escalation. CVE-2026-42018 is subtler still. Switch off anonymous access, and in some cases an unauthenticated caller can still get back an internal token meant for the anonymous user. That exposes whatever the account can reach.

Both bugs affect Artifactory Self-Hosted before version 7.133.11. CISA gave federal agencies until 25 September for these two, longer than the other three. That gap reflects deadline policy, though, not the flaw being any less real. Artifactory sits at the centre of a software supply chain. It’s where build artefacts, container images and packages live before they reach production. A privilege-escalation bug there is not simply an internal-systems problem. It’s a route into whatever your development pipeline eventually ships to customers, which is exactly why CISA treats these as actively exploited vulnerabilities rather than routine bug reports.

Why actively exploited vulnerabilities beat severity scores

None of these five flaws share a vendor, a codebase or an attack technique. What connects them is confirmed, current exploitation, and that’s the entire point of the KEV catalogue. CISA does not add a CVE because it scored high on a severity chart. It adds one because there is evidence of real attacks using it. So these are, by definition, actively exploited vulnerabilities rather than theoretical ones.

That distinction is useful for patch prioritisation well outside the US federal estate. A vulnerability scoring 9 that nobody has bothered to exploit yet is one kind of risk. A vulnerability scoring 7.5 that attackers are already using against live targets is a different, more urgent one. The KEV catalogue is a free, continuously updated way to tell the two apart. If any of these three products appear on your asset inventory, move them to the top of this week’s patching queue. Rank them ahead of anything scored purely on theoretical severity.

Work through them in the order CISA itself set. RouterOS first, since its deadline has already passed for federal agencies. Then ScreenConnect. Then Artifactory. Confirm no RouterOS device still has SSH open to the internet. Check your MSP’s ScreenConnect version. Get Artifactory onto 7.133.11 or later when your release schedule allows it. None of this takes long, and it is the fastest way to close off this week’s actively exploited vulnerabilities before they reach you.