Big federal alert: the U.S. Cybersecurity agency has dumped five freshly discovered, actively abused bugs into the Known Exploited Vulnerabilities catalog. Translation: attackers are already playing with these holes, so you should probably stop reading this sentence and start doing something useful.

What was added (the nasty bits)

Here’s the short, no-nonsense rundown of the five flaws now marked as actively exploited. CVE IDs and CVSS scores included because drama loves numbers.

  • CVE-2026-42016 — CVSS 8.1: A JFrog Artifactory authorization bug where a token’s signature/issuer is checked but the token’s scope is ignored. Result: privilege escalation is possible if attackers play their cards right.
  • CVE-2026-42018 — CVSS 7.5: Another JFrog Artifactory problem where an internal anonymous-user token can be handed back to unauthenticated callers even when anonymous access is supposedly turned off. Leaky tokens = bad times.
  • CVE-2026-84869 — CVSS 9.9: ConnectWise ScreenConnect has a privilege-management/authorization gap that can let an attacker transfer files and run them through an active remote session without host confirmation. Think rogue file drop + execution during a remote session.
  • CVE-2026-67277 — CVSS 8.8: MikroTik RouterOS missing authentication for a critical function in the btest service. Consequences include kernel memory disclosure and denial-of-service — not subtle, not nice.
  • CVE-2026-86060 — CVSS 9.2: A RouterOS command parsing bug lets attackers tweak the trusted policy mask and escalate privileges. Language-wise: injection-y and privilege-upping.

Bonus context: the two Artifactory bugs have been observed chained with another high-severity Artifactory flaw (CVE-2026-82329) to grab admin control of self-hosted servers, create persistent admin accounts, drop malicious plugins, and install backdoors. For RouterOS, some reports point to an exploit chain nicknamed “MikroTrick” used to seize devices without authentication.

What you should do (patch, poke, and panic—calmly)

Short plan: patch fast, hunt logs, lock things down. Federal civilian agencies have concrete deadlines, so if you’re responsible for a fleet of devices, the calendar is your friend.

  • Patch timelines (don’t ignore these): RouterOS fixes need to be applied by September 13, ScreenConnect by September 14, and the Artifactory fixes by September 25.
  • ScreenConnect note: update clients to the vendor-recommended build (the vendor advises a specific fixed client release) to stop rogue file transfers during remote sessions.
  • Artifactory defenders: rotate tokens, audit admin accounts, and hunt for unexpected Groovy plugins, new admin users, or strange outbound connections — these are common signs of compromise after the chained attacks.
  • RouterOS owners: if you can’t patch immediately, isolate devices from unnecessary networks, restrict management-plane access, and monitor for suspicious btest activity or unexpected policy mask changes.
  • General housekeeping: apply principle of least privilege, enable strong logging/alerting, and scan your estate for vulnerable versions. If you detect anything odd, assume the worst and investigate thoroughly.

Yes, it’s a bit of a mess, but the advice is simple: update, monitor, and tighten access. The attackers are already walking around the playground, so put the gates up.