Advisories
CISA Expands KEV Catalog with Three Fresh Exploited JFrog and ConnectWise Flaws
CISA has added three new CVEs to its Known Exploited Vulnerabilities catalog, spotlighting serious authorization lapses in JFrog Artifactory and ConnectWise ScreenConnect. The update underscores the agency’s Binding Operational Directive 26‑04, which mandates rapid patching of high‑risk flaws on publicly exposed federal assets. All organizations are urged to adopt risk‑based remediation and can submit unlisted exploited vulnerabilities via CISA’s nomination form.
In a move that tightens the federal cyber‑security posture, the Cybersecurity and Infrastructure Security Agency (CISA) has incorporated three newly discovered, actively exploited vulnerabilities into its Known Exploited Vulnerabilities (KEV) catalog. The additions target popular software platforms used across government and industry alike.
New KEV Entries
- CVE‑2026‑42016 – JFrog Artifactory: Incorrect Authorization, allowing attackers to perform actions beyond their intended scope.
- CVE‑2026‑42018 – JFrog Artifactory: Improper Authentication, enabling unauthorized access to protected resources.
- CVE‑2026‑84869 – ConnectWise ScreenConnect: Improper Privilege Management and Missing Authorization, granting attackers full control over exposed assets.
These flaws are especially dangerous because they provide a direct path for malicious actors to seize control of systems that are publicly reachable. The new entries reinforce the growing trend of exploitation focused on authorization weaknesses.
Implications for Federal Agencies
Under Binding Operational Directive (BOD) 26‑04, Federal Civilian Executive Branch (FCEB) agencies must prioritize the remediation of KEV-listed CVEs on publicly exposed assets that could grant total control after exploitation. The directive also requires agencies to verify whether a system has already been compromised before applying a patch, and to defer action on lower‑risk vulnerabilities.
While BOD 26‑04 applies only to FCEB agencies, CISA encourages all organizations—public and private—to adopt a risk‑based vulnerability management approach and to address KEV catalog flaws with urgency.
How to Get a Vulnerability Added
Organizations that discover an actively exploited vulnerability not yet in the KEV catalog can submit it through CISA’s KEV Nomination Form. Submissions must include a CVE identifier, proof of exploitation, and clear mitigation guidance.
CISA will continue to review and add vulnerabilities that meet its criteria, ensuring the catalog remains a dynamic tool for prioritizing defensive efforts.
Related vulnerabilities
CISA Expands KEV Catalog with Three New Exploited Vulnerabilities
CISA has added CVE‑2026‑42016, CVE‑2026‑42018, and CVE‑2026‑84869 to its Known Exploited Vulnerabilities catalog after confirmed active exploitation. The flaws affect JFrog Artifactory’s authorization and authentication controls and ConnectWise ScreenConnect’s privilege management, enabling attackers to gain full control of exposed assets. Federal agencies must now prioritize patching these high‑risk CVEs under BOD 26‑04, while the agency urges all organizations to adopt risk‑based remediation and report any other exploited CVEs via the KEV Nomination Form.
Read briefing
CISA Expands KEV Catalog with Four New Exploited Vulnerabilities
CISA has added four new CVEs to its Known Exploited Vulnerabilities catalog, covering critical flaws in Adobe Commerce, Microsoft Windows, and N‑central. The update highlights the agency’s push for rapid remediation of high‑risk flaws and reinforces BOD 26‑04’s prioritization rules for federal agencies.
Read briefing
CISA Expands KEV Catalog with Seven Fresh Exploited Vulnerabilities
CISA has just added seven new CVEs to its Known Exploited Vulnerabilities (KEV) catalog, all confirmed to be actively exploited in the wild. The list includes SQL injection in Sangoma Switchvox, HTTP smuggling in Kludex Starlette, OS command injection in Kestra OSS, and several high‑impact flaws in BerriAI LiteLLM, JFrog Artifactory, and SonicWall SMA1000 appliances. Under BOD 26‑04, federal agencies must prioritize patching these high‑risk items on publicly exposed assets, while the broader community is urged to adopt the same risk‑based approach and submit any missing exploited CVEs for incl
Read briefing
CISA Expands KEV Catalog with Two New MikroTik RouterOS Exploits
CISA has added two actively exploited vulnerabilities that target MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog. CVE‑2026‑67277 allows attackers to bypass authentication for a critical function, while CVE‑2026‑86060 lets them inject malicious commands by exploiting improper argument neutralization. The update reinforces federal guidance under BOD 26‑04 to prioritize rapid patching of high‑risk flaws on publicly exposed assets, and invites all organizations to adopt a risk‑based approach to remediation.
Read briefing