CISA KEV Alert: CVE-2026-42016, CVE-2026-42018 (JFrog Artifactory) and CVE-2026-84869 (ConnectWise ScreenConnect) — Detection and Remediation Guide

On September 11, 2026, CISA added three new entries to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation in the wild:

• CVE-2026-42016 — JFrog Artifactory Incorrect Authorization Vulnerability
• CVE-2026-42018 — JFrog Artifactory Improper Authentication Vulnerability
• CVE-2026-84869 — ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

This is not a theoretical exercise. A KEV listing means CISA has reliable evidence that threat actors are exploiting these flaws right now. Both affected product families sit at high-value positions in enterprise environments: Artifactory is the backbone of software supply chains and CI/CD pipelines, and ScreenConnect is a remote access platform with deep, persistent reach into endpoints. Compromise of either gives an attacker an outsized operational advantage — artifact poisoning and credential theft on one side, interactive remote control on the other.

Under Binding Operational Directive (BOD) 26-04, Prioritizing Security Updates Based on Risk, Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities within mandated timelines. Private-sector organizations are not legally bound by BOD 26-04, but treating the KEV due date as your own internal SLA remains one of the most defensible vulnerability management practices you can adopt. If it is exploited enough to make the KEV, it is exploited enough to patch this week.

Technical Analysis

CVE-2026-42016 and CVE-2026-42018 — JFrog Artifactory

JFrog Artifactory is a universal binary repository manager deployed in nearly every enterprise DevOps environment. It stores build artifacts, container images, and packages — and it holds credentials for upstream and downstream systems, making it a prime target for supply-chain compromise.

The two CVEs represent a complementary attack surface:

• CVE-2026-42018 (Improper Authentication): Flaws in this class allow an attacker to reach authenticated functionality without presenting valid credentials — typically by abusing token handling, API endpoints that fail to enforce session validation, or authentication logic that can be bypassed entirely. On Artifactory, successful exploitation means unauthenticated or under-authenticated access to the REST API and administrative functions.
• CVE-2026-42016 (Incorrect Authorization): Even where authentication succeeds, broken authorization checks allow a low-privileged (or freshly minted) session to perform actions reserved for administrators — creating users, modifying permissions, reading or overwriting artifacts, and accessing encrypted configuration data.

Chained together — or used independently depending on deployment posture — these flaws let a remote attacker move from network access to administrative control of the repository. From a defender's perspective, the worst-case outcomes are: (1) artifact poisoning, where a malicious package is injected into a repository your developers and build servers trust implicitly; (2) credential harvesting from stored configuration; and (3) persistence via attacker-created admin accounts or API keys that survive password resets.

Exposure note: Any Artifactory instance reachable from the internet — and there are many, often stood up for contractor or CI access — should be treated as presumed-targeted. Confirm your exact affected version ranges and fixed versions against the official JFrog advisory rather than assuming a recent-ish build is safe.

CVE-2026-84869 — ConnectWise ScreenConnect

ScreenConnect is a remote monitoring and management (RMM) platform used by MSPs and internal IT alike. This vulnerability combines improper privilege management with missing authorization — meaning authenticated (or partially authenticated) sessions can execute actions outside their intended privilege boundary, up to and including administrative functions on the ScreenConnect server.

The defensive stakes here are severe. ScreenConnect's entire purpose is interactive remote control, file transfer, and command execution on managed endpoints. An attacker who gains administrative control of a ScreenConnect instance inherits:

• Interactive sessions into every connected endpoint
• The ability to push arbitrary payloads through the tool's legitimate deployment mechanisms — traffic your EDR may whitelist
• Access to stored credentials and session history

This is precisely the access model that makes RMM platforms a favorite initial-access and lateral-movement vector for both ransomware affiliates and nation-state operators. ScreenConnect has been through this cycle before, and the exploitation ecosystem around it is mature: scanning for vulnerable instances begins within hours of disclosure.

Exploitation Status

All three CVEs are confirmed actively exploited — that is the explicit threshold for KEV inclusion. Treat every internet-facing instance as a target and every unpatched instance as potentially compromised. Patching alone is not sufficient; you must hunt for evidence of pre-patch compromise, particularly attacker-created accounts and persistence mechanisms.

Detection & Response

The detections below focus on the highest-fidelity post-exploitation behaviors: the Artifactory JVM or ScreenConnect server processes spawning OS commands, suspicious child processes of the RMM service, and anomalous account-creation activity. These fire on attacker behavior, not on the vulnerability itself — which is what you want, since exploitation leaves the service running but the behavior changes.

Sigma Rules

---
title: ScreenConnect Server Process Spawning Command Shell
description: Detects the ConnectWise ScreenConnect service or web server spawning command interpreters, consistent with post-exploitation of CVE-2026-84869 where an attacker abuses administrative control to execute commands on the host.
id: 3f7a1b92-8c4d-4e5a-9b21-6d0e2f8a4c77
status: experimental
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/11
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ScreenConnect.Service.exe'
      - '\ScreenConnect.WebServer.exe'
      - '\ScreenConnect.ClientService.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate technician-initiated remote commands during support sessions. Correlate with approved session logs and change windows before dismissing.
level: high
---
title: Artifactory Java Process Spawning OS Command Interpreter
description: Detects the JFrog Artifactory JVM spawning shell or scripting interpreters, a strong post-exploitation indicator following abuse of CVE-2026-42016 or CVE-2026-42018 for administrative access to the repository host.
id: 9c2e4d61-7a58-4b3f-a6d9-1e5c8b0f2a33
status: experimental
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/11
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'artifactory'
  selection_parent_img:
    ParentImage|endswith:
      - '/java'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_parent_img and selection_child
falsepositives:
  - Custom Artifactory plugins or user plugins that legitimately shell out. Baseline known plugin behavior; treat anything outside the baseline as suspicious.
level: high
---
title: Local Account Creation via ScreenConnect or Artifactory Host Processes
description: Detects net user / useradd account creation executed by remote access or repository service processes, consistent with persistence established after exploitation of KEV-listed authorization flaws.
id: 5b8f0c14-2d96-4a7e-b1c3-8e4a6d9f1b55
status: experimental
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1136/
author: Security Arsenal
date: 2026/09/11
tags:
  - attack.persistence
  - attack.t1136
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ScreenConnect.Service.exe'
      - '\ScreenConnect.WebServer.exe'
      - '\ScreenConnect.ClientService.exe'
  selection_cmd:
    CommandLine|contains:
      - 'net user'
      - 'net localgroup'
      - 'New-LocalUser'
      - 'Add-LocalGroupMember'
  selection_add:
    CommandLine|contains:
      - ' /add'
      - 'Add-'
      - 'New-'
  condition: selection_parent and selection_cmd and selection_add
falsepositives:
  - MSP automation that provisions accounts through the RMM. Verify against the MSP's documented tooling and session records.
level: critical

KQL — Microsoft Sentinel / Defender

This query hunts for shell execution under ScreenConnect and Artifactory processes, plus network connection anomalies to ScreenConnect's default ports (8040/8041). Run it across the last 30 days — pre-patch compromise is the scenario you are trying to catch.

let Lookback = 30d;
let ScreenConnectProcs = dynamic(["ScreenConnect.Service.exe", "ScreenConnect.WebServer.exe", "ScreenConnect.ClientService.exe"]);
let ShellProcs = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "rundll32.exe", "wscript.exe", "cscript.exe"]);
let ProcHunt = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where (InitiatingProcessFileName in~ (ScreenConnectProcs) and FileName in~ (ShellProcs))
     or (InitiatingProcessCommandLine has_any ("artifactory") and FileName in~ (ShellProcs))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, ReportId;
let NetHunt = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemotePort in (8040, 8041) and ActionType == "InboundConnectionAccepted"
| summarize Connections = count(), SourceIPs = make_set(RemoteIP, 25) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h);
ProcHunt
| union NetHunt
| order by TimeGenerated desc

If you ingest Artifactory's access.log and security logs via Syslog/CEF into Sentinel, also hunt for unauthenticated requests hitting administrative REST endpoints (/api/security/users, /api/system/configuration) and for user-creation events where the source IP is external or previously unseen.

Velociraptor VQL

Use this artifact to triage suspected ScreenConnect or Artifactory hosts — enumerating the service processes, their command lines, and inbound listeners on the default ScreenConnect ports.

-- Triage ScreenConnect / Artifactory hosts for post-exploitation artifacts
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)screenconnect|java'
   OR CommandLine =~ '(?i)screenconnect|artifactory'

-- Enumerate listeners on ScreenConnect default ports and their owning processes
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, State
FROM netstat()
WHERE (LocalPort in (8040, 8041) OR Name =~ '(?i)screenconnect')
  AND State =~ 'LISTEN|ESTABLISHED'

Follow up positive hits with a glob over ScreenConnect's data directory (glob(globs='C:/Program Files*/ScreenConnect/App_Data/**') or the Linux equivalent under /opt/screenconnect) to review User.xml extension definitions and recently modified files — attacker-added extensions and modified user stores are common persistence artifacts on compromised RMM servers.

Verification and Hardening Script

The PowerShell script below verifies the installed ScreenConnect version, inventories unexpected local administrators, and checks for suspicious recently created accounts. The Bash section validates Artifactory's version and pulls recent security-relevant log entries for review. Run both under an incident-response change ticket and preserve output as evidence before you patch.

# --- ScreenConnect verification (run on the ScreenConnect server) ---
$sc = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
        "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
      Where-Object { $_.DisplayName -like "*ScreenConnect*" }
$sc | Select-Object DisplayName, DisplayVersion, InstallDate
Write-Host "[!] Compare DisplayVersion against the fixed versions in the ConnectWise security advisory." -ForegroundColor Yellow

# --- Flag local admin accounts created in the last 30 days ---
Get-LocalGroupMember -Group "Administrators" | ForEach-Object {
    try { Get-LocalUser $_.Name.Split('\')[-1] | Select-Object Name, Enabled, PasswordLastSet, LastLogon } catch {}
}
Get-LocalUser | Where-Object { $_.PasswordLastSet -gt (Get-Date).AddDays(-30) } |
    Select-Object Name, Enabled, PasswordLastSet, Description

# --- Artifactory version check ---
curl -s http://localhost:8081/artifactory/api/system/version | jq .
# Compare the returned version against the fixed versions in the JFrog advisory.

# --- Hunt for recent user/permission changes in Artifactory logs ---
grep -iE "created user|add user|permission|api key|token" \
  /var/opt/jfrog/artifactory/var/log/artifactory-request.log \
  /var/opt/jfrog/artifactory/var/log/access-security.log 2>/dev/null | tail -n 200

# --- List admin users via API (requires valid admin token) and review for unknowns ---
curl -s -u "${ART_ADMIN}:${ART_TOKEN}" \
  http://localhost:8081/artifactory/api/security/users | jq '.[] | select(.admin==true) | {name, email, lastLoggedIn}'

Remediation

1. Patch immediately, then verify. Upgrade JFrog Artifactory and ConnectWise ScreenConnect to the fixed versions specified in the official vendor advisories. Do not rely on "we updated recently" — confirm the running version string against the advisory's fixed-version list. Pull the advisories directly from JFrog's and ConnectWise's security advisory pages, and cross-reference the CISA KEV Catalog entry for each CVE, including the KEV remediation due date (which FCEB agencies must meet under BOD 26-04, and which we recommend all organizations adopt as their internal SLA).
2. Assume pre-patch compromise and hunt. Apply the detections above across at least the last 30 days. Specifically audit: all Artifactory admin accounts and API keys (rotate them all — encrypted configuration credentials too), ScreenConnect extensions and user store, new local accounts on hosting servers, and outbound connections from both platforms.
3. Remove internet exposure where possible. Artifactory should not be directly internet-facing; place it behind an authenticated reverse proxy with IP allowlisting or VPN-only access. ScreenConnect should enforce MFA for all technician accounts, restrict login to known source networks, and disable any unauthenticated portal paths.
4. Constrain blast radius. Run both services under least-privilege service accounts, segment their hosts away from domain controllers and build signing infrastructure, and ensure EDR coverage includes child-process monitoring of the service binaries (per the Sigma rules above).
5. Supply-chain-specific step for Artifactory: if you find any evidence of compromise, rotate every secret stored in or proxied through Artifactory, and verify the integrity of recently published artifacts against known-good hashes before allowing builds to resume. A poisoned artifact is a downstream incident at every consumer of that repository.
6. Report and document. If hunting turns up indicators of compromise, escalate to your IR retainer immediately, preserve logs and memory images before rebuilding, and (for federal contractors and agencies) follow CISA incident reporting obligations.

The pattern in this KEV batch — broken authentication and authorization on infrastructure-tier platforms — is the defining exploitation theme of 2026. Attackers are not burning zero-days on endpoints when the repo server and the RMM will hand them the keys. Close these three, verify you weren't already beaten to it, and make KEV-driven prioritization a standing operational discipline.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub