Five Actively Exploited Vulnerabilities Added to CISA's Known Exploited Vulnerabilities Catalog

The Known Exploited Vulnerabilities catalog is not a generic list of security holes. CISA maintains it specifically for flaws that government agencies, critical infrastructure providers, and federal contractors must remediate by federal deadline. When a vulnerability lands on this list, it signals that exploitation is not hypothetical: attackers have demonstrated active code or techniques against systems in production. For organizations outside the federal supply chain, the KEV catalog serves as an early warning system and a priority ranking tool. A flaw marked as "actively exploited" by CISA typically sees a surge in attack attempts within days of the announcement.

The five vulnerabilities span different attack vectors and severity levels. CVE-2026-42016 in JFrog Artifactory carries a CVSS score of 8.1, indicating an incorrect authorization flaw that could allow an attacker to bypass access controls. Artifactory is a repository manager used by development and DevOps teams worldwide to store and distribute software binaries; a breach here can compromise the entire artifact supply chain. ConnectWise ScreenConnect and MikroTik RouterOS vulnerabilities are equally problematic because both products sit at critical chokepoints: remote desktop access for support teams and network edge devices for internet connectivity. When these types of tools are compromised, attackers gain persistence, lateral movement, or the ability to redirect traffic.

The presence of multiple vendors on a single KEV batch release indicates either a coordinated disclosure window or independent discovery during the same threat-hunting cycle. Either way, the pattern suggests attackers may already be testing cross-platform exploitation chains.

A vulnerability moves to "actively exploited" status only after CISA or trusted partners observe real attack telemetry. This is not based on proof-of-concept code posted to GitHub or hypothetical attack scenarios. It means someone has already compromised at least one system using these flaws. Ransomware operators, state-sponsored groups, and opportunistic cybercriminals monitor CISA announcements closely; some begin attacks before patches are even released. Organizations that delay patching after a KEV listing typically see scanner activity within 48 hours and exploitation attempts within a week. The narrow window between announcement and mass exploitation is why federal contractors face specific remediation deadlines, often 14 to 30 days depending on the flaw's criticality.

For private companies and smaller organizations, CISA's timeline is advisory but not mandatory, yet the underlying threat remains identical. Attackers do not differentiate between federal and non-federal targets during active exploitation phases.

If your organization uses any of the affected products, your first step is to confirm which versions are running in your environment.

1. Inventory all instances of JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS across your network, including development, staging, and air-gapped systems.
2. Cross-reference the CVE identifiers with each product's security advisory to determine which of your versions are vulnerable.
3. Prioritize patching based on network exposure: systems accessible from the internet or handling sensitive data come first.
4. Test patches in a non-production environment to catch any compatibility issues before deployment.
5. Plan a maintenance window and apply updates sequentially, starting with the highest-risk systems.
6. After patching, verify that the affected services have restarted cleanly and that logs show no unusual activity around the patch time.

Do not assume that a vendor has already released a patch. Some KEV entries remain on the list for weeks while vendors develop and validate fixes. Check the vendor's official security page and, if no patch exists, implement compensating controls: network segmentation, access restrictions, or temporary disable of the vulnerable feature if business logic permits.

Active exploitation of widely deployed software is the entry point for ransomware distribution, botnet recruitment, and supply-chain compromise. Compromised Artifactory instances can serve poisoned dependencies to downstream developers. Breached ScreenConnect installations provide attackers with legitimate remote access credentials that blend into normal support traffic. Rooted RouterOS devices become silent proxies for lateral movement and data exfiltration. All of these compromise types create leverage for extortion and data-sale operations that are advertised and negotiated on darknet forums and marketplaces. Understanding which vulnerabilities are actively exploited helps you understand which types of compromises are likely to appear in breach notifications and dark web listings within the coming months. Organizations that respond quickly to KEV listings significantly reduce the odds of their infrastructure appearing as a victim entry on extortion forums.

Open your asset management or configuration management database right now and search for these product names. If you find any, note the versions and the network location of each instance. Then visit the vendor's official security advisory page—not a cached copy, not a third-party summary—and confirm whether a patch is available. If it is, escalate the patching request to your infrastructure or security team with the CVE numbers and the "actively exploited" designation. If no patch exists yet, document your compensating controls and set a reminder to check for updates weekly. The window between announcement and mass attack is narrow; waiting for your next quarterly patch cycle is a risk your organization cannot afford.

Source: The Hacker News