CISA Adds 5 Exploited Flaws to KEV Catalog

Introduction

The cybersecurity landscape continues to escalate at a dizzying pace, and the latest update from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) is a stark reminder of that reality. CISA has officially added five newly identified vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that malicious actors are actively weaponizing these flaws in real-world attacks. The affected software spans widely used enterprise platforms — JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS — each of which plays a critical role in countless organizational infrastructures worldwide.

This development demands immediate attention from IT teams, security professionals, and business leaders alike. When CISA updates the KEV catalog, it signals that exploitation is not theoretical — it is happening now. The clock is ticking for organizations that have not yet applied available patches.

What the KEV Catalog Update Means for Organizations

CISA's Known Exploited Vulnerabilities catalog serves as one of the most authoritative references in the cybersecurity world. Each entry represents a vulnerability that has been verified through credible reports of active exploitation. Federal agencies are required by Binding Operational Directive 22-01 to remediate these flaws within strict timelines, but the implications extend far beyond government networks.

• Risk prioritization: KEV entries help security teams focus on the most dangerous and immediately threatening vulnerabilities rather than getting lost in long vulnerability queues.
• Threat intelligence: The catalog provides actionable data that informs broader threat modeling and incident response strategies.
• Compliance pressure: Many regulatory frameworks and industry standards now reference KEV entries as indicators of critical risk.

With five new flaws added in this cycle, the urgency for comprehensive vulnerability management has never been greater.

JFrog Artifactory: Incorrect Authorization Flaw Exposed

One of the critical vulnerabilities flagged in this update is CVE-2026-42016, which carries a CVSS severity score of 8.1 — placing it firmly in the "High" danger category. This flaw stems from an incorrect authorization mechanism within JFrog Artifactory, a widely deployed artifact repository manager used by development teams to store and manage software packages and build artifacts.

Artifactory is a cornerstone of modern DevSecOps pipelines. It sits at the heart of continuous integration and continuous deployment workflows, meaning a compromise here can cascade across an entire software supply chain. The incorrect authorization issue could allow unauthorized users to access restricted repositories or manipulate stored artifacts, potentially injecting malicious code into production software builds.

Given the frequency and sophistication of supply chain attacks in recent years, this particular vulnerability carries significant implications beyond its CVSS score alone.

ConnectWise ScreenConnect: Remote Access Under Siege

ConnectWise ScreenConnect, a popular remote support and access tool, has also been impacted by vulnerabilities added to the KEV catalog. ScreenConnect is used extensively by managed service providers (MSPs) and IT support teams to remotely manage client systems. Its deep access privileges make it an extraordinarily attractive target for threat actors.

In prior years, ScreenConnect has suffered from multiple high-severity flaws, including authentication bypass and arbitrary file disclosure vulnerabilities. The continued targeting of this platform suggests that attackers view it as a reliable entry point into enterprise networks. When an MSP's remote access tool is compromised, the blast radius can extend to hundreds of downstream client organizations simultaneously — a scenario that has played out in some of the most devastating ransomware campaigns of the past several years.

MikroTik RouterOS: Network Infrastructure at Risk

MikroTik RouterOS powers a vast array of networking equipment used by ISPs, enterprises, and even home networks around the globe. Its inclusion in this KEV update highlights a persistent concern: network infrastructure devices are often overlooked in patch management cycles, yet they represent the very foundation upon which all digital communication rests.

Vulnerabilities in RouterOS can enable attackers to intercept traffic, establish persistent backdoors, or disrupt connectivity across entire regions. MikroTik devices are particularly prevalent in smaller organizations and developing markets where dedicated security oversight may be limited, making them soft targets for large-scale exploitation campaigns.

Key Vulnerability Summary

• CVE-2026-42016 (JFrog Artifactory) — CVSS 8.1 — Incorrect authorization flaw enabling unauthorized access to repositories and potential supply chain compromise.
• ConnectWise ScreenConnect flaws — Multiple vulnerabilities allowing unauthorized remote access and potential lateral movement across networks.
• MikroTik RouterOS flaws — Vulnerabilities in widely deployed network infrastructure equipment with risk of traffic interception and persistent compromise.

Why Speed of Remediation Is Non-Negotiable

Every day a known vulnerability remains unpatched represents an open door for threat actors. CISA typically assigns remediation deadlines for KEV entries — often 14 days for federal agencies — but private sector organizations face their own pressures, including threat intelligence reports, dark web chatter, and active scanning from automated exploit tools.

The following remediation priorities should be top of mind:

• Immediate patching: Apply vendor-provided updates for all affected products without delay.
• Network segmentation: Isolate critical systems running vulnerable software to limit potential lateral movement.
• Access control audits: Review authorization configurations, particularly for Artifactory and ScreenConnect, to ensure least-privilege principles are enforced.
• Continuous monitoring: Deploy intrusion detection and behavioral analytics to identify signs of exploitation attempts targeting these specific CVEs.
• Inventory verification: Confirm that all instances of the affected software across the organization have been identified and assessed.

Conclusion

CISA's decision to add these five vulnerabilities to the KEV catalog is not just an administrative update — it is a clear and urgent call to action. The affected platforms touch everything from software development pipelines to remote workforce support to core network routing, making their compromise a threat with far-reaching consequences. Organizations that delay response risk becoming the next headline.

In an era where threat actors exploit known gaps with increasing speed and precision, staying ahead requires more than periodic vulnerability scans. It demands intelligent automation, real-time threat correlation, and a security posture that adapts as fast as the threats themselves. Platforms like Grivyonx Cloud leverage advanced AI automation and cyber intelligence to help organizations detect, prioritize, and neutralize emerging threats before they can be weaponized — turning reactive security into proactive defense.