CISA Adds Five KEV Entries for Chained Artifactory, ScreenConnect, and MikroTik Exploits

CISA's September 2026 update lists two JFrog Artifactory flaws that together permit token scope bypass and anonymous token leakage, enabling full admin takeover when combined with the earlier CVE-2026-82329. Wiz telemetry shows persistent Groovy plugins and Rust backdoors deployed against self-hosted instances between 15 August and 8 September. The pattern matches prior supply-chain abuse of artifact repositories where token validation was limited to signature rather than authorization scope. Huntress documented three unrelated ScreenConnect incidents where CVE-2026-84869 allowed file transfer and execution inside active sessions without host confirmation, limited to the client side. ConnectWise's advisory treats the issue as a client condition rather than server exposure, yet the abuse vector directly extends remote-management tooling that already carries high trust assumptions. MikroTik's pair of RouterOS flaws, tracked by CERT Polska as MikroTrick, permit unauthenticated kernel memory reads and policy-mask alteration in the btest service. Federal Civilian Executive Branch agencies must remediate the RouterOS flaws by 13 September, ScreenConnect by 14 September, and Artifactory by 25 September. Procurement records show MikroTik devices remain common in edge routing for critical infrastructure operators despite repeated RouterOS disclosure chains since 2022. No independent technical attribution to a named actor group has been released; observed tooling is commodity Rust implants and VBScript droppers. Continued monitoring of Artifactory plugin repositories and MikroTik btest traffic will indicate whether the KEV deadlines compress the observed exploitation window or simply shift activity to unpatched third-party instances.