/
← Voltar ao feed
high government

CISA adds JFrog Artifactory CVE-2026-42016 and CVE-2026-42018 and ConnectWise ScreenConnect CVE-2026-84869 to KEV

1 fonte(s) · 1 atualização(ões) · publicado 11/09/2026 09:00 · coletado há 1 dia

CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Two affect JFrog Artifactory: CVE-2026-42016 (incorrect authorization) and CVE-2026-42018 (improper authentication). The third is CVE-2026-84869 in ConnectWise ScreenConnect (improper privilege management and missing authorization). CISA describes these vulnerability types as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no exploitation details, threat actor attribution, victim information or IOCs.

Technical Details

  • CVE-2026-42016: JFrog Artifactory Incorrect Authorization Vulnerability.
  • CVE-2026-42018: JFrog Artifactory Improper Authentication Vulnerability.
  • CVE-2026-84869: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability.
  • The article does not list affected versions, exploitation methods or the impact of exploitation.

Remediation

  • Under BOD 26-04, Federal Civilian Executive Branch (FCEB) agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation.
  • BOD 26-04 also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
  • CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog remediation.
  • The article gives no specific patch guidance; consult the JFrog and ConnectWise vendor advisories.

Linha do tempo

  1. cisa.gov ↗ · pub. 11/09/2026 09:00 · coletado 19/10 18:37 primeiro registro

    CISA adds JFrog Artifactory CVE-2026-42016 and CVE-2026-42018 and ConnectWise ScreenConnect CVE-2026-84869 to KEV

    ler a análise desta fonte

    CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Two affect JFrog Artifactory: CVE-2026-42016 (incorrect authorization) and CVE-2026-42018 (improper authentication). The third is CVE-2026-84869 in ConnectWise ScreenConnect (improper privilege management and missing authorization). CISA describes these vulnerability types as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no exploitation details, threat actor attribution, victim information or IOCs.

    Technical Details

    • CVE-2026-42016: JFrog Artifactory Incorrect Authorization Vulnerability.
    • CVE-2026-42018: JFrog Artifactory Improper Authentication Vulnerability.
    • CVE-2026-84869: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability.
    • The article does not list affected versions, exploitation methods or the impact of exploitation.

    Remediation

    • Under BOD 26-04, Federal Civilian Executive Branch (FCEB) agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation.
    • BOD 26-04 also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
    • CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog remediation.
    • The article gives no specific patch guidance; consult the JFrog and ConnectWise vendor advisories.