CISA Adds Five Actively Exploited Vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA maintains the Known Exploited Vulnerabilities catalog as a living list of security flaws that have evidence of active exploitation. When a vulnerability lands on this list, it transitions from theoretical threat to confirmed real-world attack. Federal agencies and critical infrastructure operators are required to patch KEV-listed flaws within defined timelines. For private enterprises and smaller organizations, inclusion on the KEV catalog should trigger the same urgency: if attackers are already using the exploit, every day you delay patching is a day the flaw can be leveraged against your environment.

The five flaws added in September span different attack vectors and severity levels. They touch infrastructure that spans artifact repositories, remote support platforms, and network edge devices, meaning organizations that run any of these tools are likely to be affected. The CVSS score of 8.1 for the authorization flaw signals high severity, though the full technical details vary by CVE.

JFrog Artifactory serves as a central repository for software artifacts and build dependencies, making it a high-value target for supply-chain attacks. A flaw in authorization controls could allow an unauthenticated or low-privileged attacker to bypass access controls and exfiltrate proprietary code or inject malicious artifacts into the build pipeline. ConnectWise ScreenConnect is remote support software used by managed service providers and internal IT teams, so exploitation would grant attackers direct interactive access to customer systems at scale. MikroTik RouterOS powers network routing and edge security in thousands of networks worldwide, particularly in smaller and mid-market deployments where patch cycles are slower.

The combination of these three products in a single wave of KEV additions suggests either coordinated disclosure or a period where multiple zero-days were discovered independently. Attackers often scan for and exploit multiple flaws in a single campaign, chaining them together to move from initial access to persistence and lateral movement.

Once a vulnerability is public and proof-of-concept code becomes available, the time between disclosure and active exploitation has shrunk to hours or days. Underground forums on the dark web and private hacking channels share working exploits almost immediately. Scanning tools are updated to detect unpatched instances. Mass exploitation campaigns often begin within 48 hours of a high-impact flaw becoming known. Many organizations operate under the assumption that they have weeks to patch, but the real-world timeline is much shorter for KEV-listed flaws.

The gap between vendor patch release and organizational deployment is where most breaches occur. Even if a vendor releases a fix on day one, staging the patch, testing it in a non-production environment, scheduling maintenance windows, and rolling it out across multiple servers can take two to four weeks. During that window, active scanning and exploitation is already underway.

Attackers use automated reconnaissance to identify which organizations are running vulnerable versions of Artifactory, ScreenConnect, or RouterOS. Shodan, Censys, and similar search engines index these services across the internet. Once a vulnerability is known, attackers query these databases to build target lists. Internal chatter on dark web forums and private Telegram channels quickly spreads working exploit code and targeting strategies. Organizations that do not patch within the first week of a KEV listing often find themselves already compromised by the time the patch is deployed.

The reconnaissance and exploitation pipeline moves much faster than most IT departments expect. If your organization's patch schedule allows two to four weeks for critical patches, you are already behind the active exploitation timeline.

If your organization runs any of these three products, prioritize the following steps:

1. Identify all instances of JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS in your environment, including dev and staging instances.

1. Check the current version running on each instance against the CISA advisory to determine which specific CVEs affect you.

1. Retrieve the vendor patch from the official release channel and test it in a non-production replica of your environment before deployment.

1. Schedule patching within 48 hours if the vulnerability affects a directly internet-facing system, or within one week for internal-only systems.

1. Monitor authentication logs and traffic patterns on affected systems for signs of reconnaissance or failed exploitation attempts.

1. If you cannot patch immediately due to business constraints, implement compensating controls such as network segmentation, IP allowlisting, or temporary service shutdown.

1. Review vendor advisories and CISA guidance directly from official sources to avoid confusion from third-party interpretations.

Organizations that respond faster to KEV listings tend to have flatter approval hierarchies, pre-staged test environments, and patch testing that runs in parallel rather than sequentially. Consider shifting from a scheduled monthly patch cycle to a risk-based model where critical flaws are treated as incidents. Establish relationships with your vendors so you receive advance notice of patches before public disclosure. Use vulnerability scanning in your continuous integration pipeline to detect if developers have used an artifact or library that matches a known-vulnerable component.

The organizations that rarely get breached through these vulnerabilities share a common trait: they patch within 72 hours of CISA adding a flaw to the KEV catalog. Everything else is risk management theater. The question is whether your organization has the processes in place to move at that speed, or whether you are hoping that attackers will not target you.

Do not wait for guidance from your vendor or a second-hand security alert. Navigate directly to the CISA website, review the official advisory for each CVE, and cross-reference it against your asset inventory today. Check the Useful Resources page on this site for links to official CISA bulletins and verify any vendor patch links through the manufacturer's official security advisory channels, not through aggregator sites. If you operate a managed service provider or support organization, audit your client environments and prioritize alerting clients who run these products. The organizations that survive active exploitation campaigns are the ones that act in the first 48 hours, not the ones that debate priority the following week.

Source: The Hacker News