CISA added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog this week, spanning JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS, each carrying a federal remediation deadline of September 13, 14, or 25. The batch itself is routine; CISA adds new entries most weeks. What is not routine is the gap it exposes between how fast these vulnerabilities move from disclosure to active exploitation and how slowly the organizations running the affected software actually patch, a gap that research from cloud security firm Wiz has now put a number on.
The Week’s Batch
Two of the new entries affect JFrog Artifactory, the artifact repository thousands of software teams use to store and distribute build packages: CVE-2026-42016, an incorrect authorization flaw that lets a low-privilege token escalate itself (CVSS 8.1), and CVE-2026-42018, an improper authentication flaw that can return an internal access token to a caller who was never authenticated (CVSS 7.5). CISA has set a September 25 deadline for federal agencies to remediate both. A third Artifactory flaw in the same family, CVE-2026-82329, an authentication bypass rated critical, was disclosed alongside them and is already being chained with the other two in live attacks. JFrog’s own security advisories describe the root cause plainly: under default configuration, the flaw “may allow an unauthenticated attacker with network access to obtain administrative privileges.” For instances that cannot upgrade immediately, JFrog’s documented mitigation is to configure an additional join key, which closes the specific default-configuration gap the attackers have been exploiting to mint themselves admin tokens.
The largest single entry belongs to ConnectWise ScreenConnect, the remote access software widely used by managed service providers: CVE-2026-84869 lets an attacker transfer and execute files through an already active remote session without the host’s authorization, and carries a CVSS score of 9.9. CISA gave federal agencies until September 14, a day after the two MikroTik RouterOS flaws also added this week, one of which CyberTech has already reported on being chained together to hijack routers earlier this month.
Media Partner
The Gap Between Disclosure and Adoption
The more useful number in this story is not the CVSS score. It is Wiz’s patch-adoption tracking, published as it investigated the Artifactory flaws’ in-the-wild exploitation. According to Wiz, 67 percent of organizations running Artifactory had at least one vulnerable instance when CVE-2026-42016 was first disclosed on July 27. Six weeks later, 59 percent still did. CVE-2026-42018, disclosed August 12, has moved even less: from 69 percent vulnerable at disclosure to 62 percent after four weeks. Only the critical-rated CVE-2026-82329 shows a meaningfully faster curve, dropping from 67 percent to 49 percent within two weeks of its August 28 disclosure, which Wiz attributes to its severity rating pulling more urgent attention from security teams than the high-severity pair sitting next to it.
That pattern, a critical bug getting patched while its higher and lower severity siblings in the same exploit chain do not, is the actual story. Attackers do not need the critical flaw alone. Wiz’s research describes attackers chaining the authentication bypass with the improper-authentication and incorrect-authorization pair to create persistent administrator accounts, install malicious Groovy plugins for code execution, and drop Rust-based backdoors that survive a later patch of the entry-point vulnerability. Patching the headline CVE while leaving its supporting cast unpatched does not close the door; it just makes the remaining doors less visible.
What This Means for the Security Leader
CISA’s Known Exploited Vulnerabilities catalog exists to force prioritization. As the agency states on the catalog itself, “CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.” That framing treats KEV membership as the trigger for action. What the Artifactory data shows is that even KEV membership, plus a hard federal deadline, plus public reporting of active exploitation, still leaves a majority of affected organizations unpatched weeks later outside the federal enterprise CISA can actually compel. Private-sector security teams do not answer to Binding Operational Directive deadlines, and the Wiz numbers suggest a meaningful share are not treating them as deadlines regardless.
The practical failure is rarely a missing patch schedule. It is that a vulnerability chain gets triaged CVE by CVE, ranked by CVSS score, and the two flaws attackers actually need together get separated onto different remediation timelines because one looks worse on paper than the other. A CISO evaluating exposure this week should treat every CVE in a named exploit chain as one ticket, not several, so that a “high” severity flaw sitting next to a “critical” one in the same advisory does not quietly slip to next sprint. CyberTech has seen the same under-the-radar-severity problem play out with GitLab’s own perfect-10 flaw drawing active probing within days of its disclosure this month, well before most self-managed instances had upgraded.
What To Do Now
Security teams running JFrog Artifactory should treat all three CVEs as one remediation ticket rather than three separate ones ranked by severity, and confirm every self-hosted instance is on the fixed build for its release branch: 7.111.20 or 7.111.21, 7.117.27 or 7.117.28, 7.125.19 or 7.125.20, 7.133.28 or 7.133.29, 7.146.8 or 7.146.38, or 7.161.20, depending on which branch is deployed. Instances that cannot upgrade immediately should configure an additional join key as JFrog’s own advisory recommends, since that mitigation directly closes the default-configuration path attackers have been using. ScreenConnect operators should apply version 26.6.5 immediately given the September 14 federal deadline and the flaw’s 9.9 severity, and in the interim strip the TransferFiles permission from any session that does not explicitly need it. Anyone running an affected MikroTik RouterOS build should treat CISA’s September 13 deadline as due today and prioritize the patch immediately, not this sprint.
Source: Wiz Research
