The US Cybersecurity and Infrastructure Security Agency added five vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog, The Hacker News reported on September 12, 2026, following reports of active exploitation. Security Affairs reported the same additions, noting GitLab alongside Artifactory and ScreenConnect in CISA's mid-September entries.
The three products have little in common functionally and everything in common structurally. Artifactory stores and serves the build artifacts an organization deploys. ScreenConnect reaches into endpoints for remote support. RouterOS moves the traffic. Each one is a tool that manages other machines.
Why it matters
Compromising management software collapses the usual attack path. An attacker who controls an artifact repository can taint what gets deployed; one who controls a remote-support tool already has the mechanism for reaching thousands of endpoints, built and authorized; one who controls the router sees and shapes the traffic.
This is also why KEV membership deserves different treatment from a high CVSS score. Severity models describe what a flaw could do in theory. The catalog records that someone is doing it.
How it works
CISA adds an entry when it has evidence of exploitation in the wild, which triggers a binding operational directive requiring federal civilian executive branch agencies to remediate by a set date. Private organizations are not bound by the deadline, but the catalog is widely used as a prioritization feed precisely because it filters for what is being used against real targets.
This report does not include exploitation details. The operationally useful facts are the affected products and the existence of vendor fixes.
Evidence
The Hacker News reported on September 12, 2026 that CISA added five flaws impacting JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to the KEV catalog following reports of active exploitation. Security Affairs reported on September 14, 2026 that CISA's recent additions covered GitLab, JFrog Artifactory and ConnectWise ScreenConnect flaws. Separately, CISA's own September 14 alert records the addition of a Cisco Secure Email Gateway SQL injection vulnerability, CVE-2026-76461.
What defenders should do
Patch the three product families first, ahead of anything else queued this cycle, and check version numbers rather than trusting an inventory record. Then reduce exposure: none of these systems needs to be reachable from the public internet for most organizations, and putting them behind an authenticated gateway removes the majority of opportunistic attempts.
Because these are management tools, assume-breach hygiene is worth the effort even after patching: rotate service accounts and API tokens, review remote-session and artifact-publish logs for unfamiliar sources, and confirm that recently published artifacts match what your build pipeline actually produced.
What happens next
Remote monitoring and management software has been a favoured route into downstream customers for years, and nothing in this batch suggests that changes. Expect further KEV additions in the same category, and expect insurers and auditors to keep tightening questions about internet-exposed management interfaces.