CISA KEV Flash: 14 CVEs Added — ConnectWise, JFrog, GitLab & Citrix Under Active Attack | Security Arsenal

Between September 8–11, 2026, CISA added 14 CVEs to the Known Exploited Vulnerabilities catalog — one of the densest single-week waves we have tracked this year. Every entry on this list is confirmed actively exploited in the wild. This is not theoretical risk: threat actors are weaponizing these flaws right now against remote access infrastructure, CI/CD pipelines, network edge devices, and enterprise Windows estates.

The wave is dominated by authentication bypass and privilege escalation primitives — the exact vulnerability classes favored by ransomware affiliates and initial access brokers (IABs). Four of the fourteen entries affect products that sit directly on the attack path of managed service providers (MSPs) and software supply chains: ConnectWise ScreenConnect, N-able N-central, JFrog Artifactory, and GitLab. History tells us that when MSP tooling and artifact repositories burn, downstream compromise follows within days.

Active Exploitation Intelligence

CVE-2026-84869 — ConnectWise ScreenConnect (Added 2026-09-11)

Vulnerability: Improper privilege management combined with missing authorization (CWE-269/CWE-862) in ScreenConnect remote access software.
Exploitation method: Unauthenticated or low-privileged attackers can escalate to administrative control of the ScreenConnect server, yielding remote code execution on every managed endpoint connected to the instance. This mirrors the exploitation pattern of CVE-2024-1708/1709, which was mass-exploited by ransomware operators including Black Basta and Bl00dy affiliates within 48 hours of disclosure.
Threat actors: Ransomware usage currently listed as Unknown, but ScreenConnect is a top-three ransomware initial access vector; assume IAB resale of access is already occurring.
PoC status: Not confirmed public as of this writing, but KEV listing implies working in-the-wild exploit code.
CISA required action: Apply vendor mitigations per the ConnectWise advisory or discontinue use if mitigations are unavailable. BOD 22-01 binding deadline applies to federal civilian agencies (typically ~3 weeks from listing).

CVE-2026-42016 & CVE-2026-42018 — JFrog Artifactory (Added 2026-09-11)

CVE-2026-42016: Incorrect authorization flaw enabling privilege escalation via a validation check failure.
CVE-2026-42018: Improper authentication flaw that can return an internal anonymous-user token to an unauthenticated attacker — effectively handing out valid session material to anyone who asks.
Exploitation method: Chained, these flaws allow a fully unauthenticated remote attacker to obtain a token, escalate to admin, and push poisoned artifacts into the software supply chain or exfiltrate proprietary packages and stored credentials.
Threat actors: Unattributed, but Artifactory sits upstream of developer build pipelines — this is a supply-chain adversary's ideal target. Treat as APT-grade exposure.
PoC status: Not confirmed public; active exploitation confirmed by CISA.
CISA required action: Apply vendor patch per JFrog advisory; federal deadline under BOD 22-01.

CVE-2026-85706 — GitLab CE/EE (Added 2026-09-11)

Vulnerability: Path traversal allowing an unauthenticated user to read arbitrary files from the GitLab server.
Exploitation method: Crafted requests with directory traversal sequences read secrets.yml, database credentials, CI/CD tokens, and private repository content. Stolen tokens pivot directly into source code and deployment pipelines.
Threat actors: Unattributed; GitLab flaws historically attract both ransomware crews (extortion via stolen source) and espionage actors (supply-chain positioning).
CISA required action: Upgrade per GitLab security release; binding federal deadline applies.

CVE-2026-86060 & CVE-2026-67277 — MikroTik RouterOS (Added 2026-09-10)

CVE-2026-86060: Improper neutralization of argument delimiters in a command (argument injection, CWE-88) allowing an attacker to alter device configuration.
CVE-2026-67277: Missing authentication for a critical function enabling kernel memory disclosure and denial of service.
Exploitation method: Memory disclosure leaks credentials and session material; argument injection converts that into persistent configuration control. MikroTik botnets (Mēris, RouterOS-based DDoS and proxy infrastructure) have a long history of absorbing new RouterOS CVEs within days.
Threat actors: RouterOS exploitation is strongly correlated with botnet operators and state proxy-network builders.
CISA required action: Apply RouterOS updates per MikroTik advisory; restrict management interfaces immediately.

CVE-2026-19490 — Citrix NetScaler ADC/Gateway (Added 2026-09-09)

Vulnerability: Authentication bypass via alternate path or channel (CWE-288).
Exploitation method: Attackers bypass gateway authentication to reach internal resources — the same kill-chain shape as CitrixBleed (CVE-2023-4966), which was exploited by LockBit, AlphV/BlackCat affiliates, and multiple APTs.
Threat actors: NetScaler is the single most ransomware-abused edge product class; assume rapid adoption by affiliate crews.
CISA required action: Apply Citrix patch; terminate all active sessions post-patch to invalidate stolen session material.

CVE-2026-20079 — Cisco Secure FMC / SCC Firewall Management (Added 2026-09-09)

Vulnerability: Authentication bypass in the firewall management plane.
Exploitation method: Compromising FMC grants control over policy for every managed firewall — an attacker can open holes, disable inspection, and blind the SOC. Cisco management-plane flaws (e.g., the 2024 ASA/FTD campaign, ArcaneDoor) have been staples of state-sponsored edge-device operations.
CISA required action: Patch per Cisco advisory; audit FMC admin accounts and policy change history.

CVE-2025-25249 — Fortinet FortiOS / FortiSwitchManager / FortiSASE (Added 2026-09-09)

Vulnerability: Heap-based buffer overflow allowing an attacker to execute unauthorized code or commands.
Exploitation method: Pre-authentication RCE on the security fabric itself. Fortinet edge CVEs are among the fastest-weaponized in the KEV catalog (FortiOS SSL-VPN flaws have repeatedly hit mass exploitation within 72 hours).
CISA required action: Upgrade per Fortinet PSIRT advisory; if patching is deferred, disable exposed management interfaces as interim mitigation.

CVE-2026-87491 — Google Chromium V8 (Added 2026-09-09)

Vulnerability: Out-of-bounds write in the V8 JavaScript engine enabling arbitrary code execution inside the renderer sandbox.
Exploitation method: Drive-by compromise via a malicious web page; typically chained with a sandbox escape for full host compromise. V8 flaws are the bread and butter of commercial spyware vendors and APT watering-hole campaigns.
CISA required action: Update Chrome/Chromium-based browsers; enforce enterprise browser auto-update policies.

CVE-2026-86218 — N-able N-central (Added 2026-09-08)

Vulnerability: Static code injection enabling pre-authentication remote code execution.
Exploitation method: Unauthenticated RCE on an RMM platform = instant push-access to thousands of downstream managed endpoints. This is a SolarWinds/Kaseya-class exposure profile for MSPs.
CISA required action: Patch immediately per N-able advisory; audit for unauthorized scripts and new local accounts on the N-central host.

CVE-2026-75650 — Adobe Commerce / Magento Open Source (Added 2026-09-08)

Vulnerability: Improper neutralization of special elements in a template engine (SSTI-class).
Exploitation method: Server-side template injection escalates to RCE on e-commerce infrastructure — card skimming, Magecart-style payment theft, and webshell deployment. The CosmicSting (CVE-2024-34102) campaign demonstrated how fast Magento flaws convert to mass store compromise.
CISA required action: Apply Adobe security update; scan storefronts for unauthorized template modifications.

CVE-2026-81963 — Microsoft Windows Update Stack (Added 2026-09-08)

Vulnerability: Link following (CWE-59) flaw allowing a local attacker to escalate privileges to SYSTEM.
Exploitation method: Post-compromise LPE — attackers abuse symlink/junction handling in the update stack to overwrite protected files. LPE-in-update-stack bugs (cf. CVE-2024-38063-adjacent update flaws) are routinely paired with initial RCEs by ransomware operators for defense evasion and persistence.
CISA required action: Apply the September 2026 cumulative update.

CVE-2026-85880 — Microsoft Windows ALPC (Added 2026-09-08)

Vulnerability: Heap-based buffer overflow in Advanced Local Procedure Call enabling privilege elevation.
Exploitation method: Local privilege escalation to SYSTEM from any user context — a classic second-stage payload for hands-on-keyboard intrusions and commodity malware.
CISA required action: Apply the September 2026 cumulative update.

Affected Organizations Assessment

Exposed environments:

MSPs and IT service providers — ScreenConnect and N-central compromise cascades to every downstream client. A single unpatched RMM server can seed dozens of ransomware incidents.
Software development organizations — Artifactory and GitLab exposure threatens build integrity; any org pushing artifacts to production from a vulnerable instance must assume pipeline poisoning risk.
Edge-heavy enterprises — NetScaler, Fortinet, Cisco FMC, and MikroTik devices define the perimeter of most Fortune 2000 networks and nearly all SMB networks (MikroTik is ubiquitous in ISP/WISP and retail edge deployments).
E-commerce — Adobe Commerce/Magento powers a significant share of mid-market online retail; patch adoption in this sector historically lags 30–60 days due to storefront change-control freezes.
All Windows estates — the two Microsoft LPEs affect every organization running unpatched September builds; they are force-multipliers for any other intrusion.

Exposure scale: Edge network devices (Fortinet, NetScaler, MikroTik) consistently show the slowest remediation curves — industry telemetry routinely shows 30–50% of internet-facing instances still vulnerable 30 days post-advisory. RMM and self-hosted DevOps tooling (ScreenConnect, GitLab, Artifactory) fare better among SaaS-mature orgs but self-hosted and legacy instances linger unpatched for months. Chromium updates propagate fastest (days) where auto-update is enforced.

Fastest exploitation sectors (historical): Healthcare, local government, education, and manufacturing absorb the most ransomware hits following RMM/edge CVEs (via affiliates leveraging ConnectWise/NetScaler access). Technology and financial services are the primary targets for supply-chain-oriented Artifactory/GitLab compromise. Retail sees the quickest Magecart-style conversion of Magento flaws.

Detection Engineering

Sigma Rules

YAML

---
title: ConnectWise ScreenConnect Suspicious Child Process Execution
id: 7f3a91c2-1e5b-4d8a-9c3e-2026kev84869
status: experimental
description: Detects suspicious command shell or script interpreter child processes spawned by the ScreenConnect service, consistent with post-exploitation of CVE-2026-84869 (auth/privilege flaws leading to RCE on managed endpoints).
author: Security Arsenal Threat Intel
date: 2026/09/11
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.Service.exe'
      - '\ScreenConnect.WindowsClient.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
  filter_known_admin:
    CommandLine|contains:
      - 'ScreenConnect'
      - 'reinstall'
  condition: selection_parent and selection_child and not filter_known_admin
falsepositives:
  - Legitimate administrative scripts executed by technicians via ScreenConnect sessions
  - RMM maintenance tasks — baseline and allowlist known technician activity
---
title: GitLab Unauthenticated Path Traversal Exploitation Attempt
id: 2b8d44e7-9a1c-4f2b-8e6d-2026kev85706
status: experimental
description: Detects HTTP requests containing directory traversal sequences targeting GitLab instances, consistent with CVE-2026-85706 arbitrary file read exploitation (secrets.yml, CI tokens, repository data theft).
author: Security Arsenal Threat Intel
date: 2026/09/11
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: webserver
level: critical
detection:
  selection_uri:
    c-uri|contains:
      - '..%2f'
      - '..%252f'
      - '%2e%2e'
      - '../'
      - '..\\'
      - '%2e%2e%2f'
  selection_targets:
    c-uri|contains:
      - 'secrets.yml'
      - 'gitlab.rb'
      - '/etc/passwd'
      - 'database.yml'
      - '.env'
      - 'id_rsa'
      - 'config.toml'
  filter_internal:
    c-ip|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_uri and (selection_targets or (selection_uri and not filter_internal))
falsepositives:
  - Vulnerability scanners and authorized penetration tests — correlate with scanner IP ranges
---
title: JFrog Artifactory Anonymous Token Abuse and Privilege Escalation
id: 5e1c09a3-3d7f-4b91-a2c8-2026kev42018
status: experimental
description: Detects suspicious anonymous-token API usage and unauthorized admin/API-key creation on JFrog Artifactory, consistent with exploitation of CVE-2026-42016 and CVE-2026-42018 (unauthenticated token disclosure and privilege escalation).
author: Security Arsenal Threat Intel
date: 2026/09/11
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: webserver
level: critical
detection:
  selection_api:
    c-uri|contains:
      - '/artifactory/api/security/users'
      - '/artifactory/api/security/apiKey'
      - '/artifactory/api/security/token'
      - '/artifactory/api/security/permissions'
      - '/artifactory/api/security/groups'
  selection_methods:
    cs-method:
      - POST
      - PUT
  selection_auth_anomaly:
    cs-username:
      - 'anonymous'
      - '-'
      - ''
  filter_admin_hosts:
    c-ip|startswith:
      - '10.'
      - '192.168.'
  condition: selection_api and selection_methods and selection_auth_anomaly and not filter_admin_hosts
falsepositives:
  - CI/CD automation creating service tokens — allowlist known build-server service accounts and IPs

KQL — Microsoft Sentinel Hunt Query

KQL — Microsoft Sentinel / Defender

// KEV Wave 2026-09-08..11 — Hunt: GitLab traversal, Artifactory token abuse, NetScaler/auth-bypass edge probing, ScreenConnect/N-central RMM anomaly
let SuspiciousTraversal = dynamic(["..%2f","%2e%2e","../","..%252f","secrets.yml","database.yml","gitlab.rb","/etc/passwd","id_rsa"]);
let ArtifactorySecurityAPI = dynamic(["/artifactory/api/security/users","/artifactory/api/security/token","/artifactory/api/security/apiKey","/artifactory/api/security/permissions"]);
let EdgeMgmtHosts = dynamic(["netscaler","citrix","forti","fmc","mikrotik","routeros"]);
union isfuzzy=true
  (W3CIISLog
   | where csUriStem has_any (SuspiciousTraversal) or csUriQuery has_any (SuspiciousTraversal)
   | project TimeGenerated, cIP, sIP, csUriStem, csUriQuery, csUserName, scStatus, csUserAgent, Source="IIS"),
  (CommonSecurityLog
   | where (RequestURL has_any (SuspiciousTraversal) or RequestURL has_any (ArtifactorySecurityAPI))
      and (RequestMethod in ("POST","PUT","GET"))
   | project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, RequestClientApplication, Source="CEF"),
  (SigninLogs
   | where ResultType != 0
   | summarize FailedAttempts=count(), IPs=make_set(IPAddress) by UserPrincipalName, AppDisplayName, bin(TimeGenerated, 1h)
   | where FailedAttempts > 25
   | project TimeGenerated, UserPrincipalName, AppDisplayName, FailedAttempts, IPs, Source="AAD-BruteForce-PostAuthBypass"),
  (DeviceProcessEvents
   | where InitiatingProcessFileName has_any ("ScreenConnect","n-central","NCentral","TakeControl")
     and FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","mshta.exe","rundll32.exe","certutil.exe","wscript.exe","net.exe","nltest.exe")
   | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, Source="RMM-ChildProc"),
  (DeviceNetworkEvents
   | where RemotePort in (8443, 8040, 8041, 8042, 443)
     and InitiatingProcessFileName in~ ("cmd.exe","powershell.exe","w3wp.exe","java.exe","node.exe")
     and RemoteIPType == "Public"
   | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl, Source="Mgmt-Egress")
| extend IndicatorHit = case(
    Source == "RMM-ChildProc", "CVE-2026-84869 / CVE-2026-86218 (RMM abuse)",
    Source in ("IIS","CEF"), "CVE-2026-85706 / CVE-2026-42016/42018 (traversal/token abuse)",
    Source == "AAD-BruteForce-PostAuthBypass", "CVE-2026-19490 / CVE-2026-20079 (auth bypass follow-on)",
    Source == "Mgmt-Egress", "Edge device post-exploitation egress",
    "Review")
| order by TimeGenerated desc

Remediation & Inventory Script — PowerShell

PowerShell

#requires -RunAsAdministrator
<#
.SYNOPSIS
  KEV Wave 2026-09-08..11 - Inventory, Patch Verification, and Exposure Report
.DESCRIPTION
  1. Inventories installed vulnerable products (ScreenConnect, GitLab runner, Artifactory,
     N-central, Chromium-based browsers, Adobe Commerce indicators).
  2. Verifies Windows September 2026 cumulative update presence for CVE-2026-81963 / CVE-2026-85880.
  3. Flags internet-facing edge devices requiring manual firmware/vendor patching.
  4. Outputs a remediation report. Exit code 1 if any exposure remains.
.NOTES
  Run on Windows servers/endpoints. Adjust $MinimumBuild and $RequiredKBPatterns to the
  fixed versions published in the relevant vendor advisories before deployment.
#>

$ErrorActionPreference = 'SilentlyContinue'
$report = [System.Collections.Generic.List[object]]::new()
$exposed = $false

function Add-Finding($Product, $Path, $Version, $Status, $Action) {
  $script:report.Add([pscustomobject]@{
    Product=$Product; InstallPath=$Path; Version=$Version; Status=$Status; RequiredAction=$Action
  })
}

# ---------- 1. Installed product inventory ----------
$uninstallKeys = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$installed = Get-ItemProperty $uninstallKeys |
  Select-Object DisplayName, DisplayVersion, InstallLocation

$targets = @{
  'ScreenConnect' = @{ Pattern='ScreenConnect'; Advisory='https://www.connectwise.com/company/trust/security-bulletins'; CVE='CVE-2026-84869' }
  'N-central'     = @{ Pattern='N-central|Nable|SolarWinds MSP'; Advisory='https://www.n-able.com/security-advisories'; CVE='CVE-2026-86218' }
  'GitLab'        = @{ Pattern='GitLab'; Advisory='https://about.gitlab.com/releases/categories/releases/'; CVE='CVE-2026-85706' }
  'Artifactory'   = @{ Pattern='Artifactory|JFrog'; Advisory='https://jfrog.com/help/r/jfrog-security-advisories'; CVE='CVE-2026-42016/42018' }
  'Chrome'        = @{ Pattern='Google Chrome|Microsoft Edge'; Advisory='https://chromereleases.googleblog.com/'; CVE='CVE-2026-87491' }
}

foreach ($t in $targets.GetEnumerator()) {
  $hits = $installed | Where-Object { $_.DisplayName -match $t.Value.Pattern }
  foreach ($h in $hits) {
    # ACTION: Compare $h.DisplayVersion against the fixed version in the vendor advisory.
    Add-Finding $t.Key $h.InstallLocation $h.DisplayVersion "INSTALLED - VERIFY vs $($t.Value.CVE) fix" "Patch per $($t.Value.Advisory)"
    $exposed = $true
  }
}

# Service-based detection for products not registering in Uninstall hives
foreach ($svc in 'ScreenConnect Client*','N-central*','artifactory*','gitlab*') {
  $s = Get-Service -Name $svc
  if ($s) { Add-Finding $svc $s.Name 'service-present' 'SERVICE DETECTED - verify patch level' 'Check vendor advisory'; $exposed = $true }
}

# ---------- 2. Windows September 2026 update verification (CVE-2026-81963 / CVE-2026-85880) ----------
$os = Get-CimInstance Win32_OperatingSystem
$build = [int]$os.BuildNumber
$hotfixes = (Get-HotFix).HotFixID
# Populate with the KB numbers from the Sept 2026 MSRC advisories before running in production
$RequiredKBPatterns = @('KB50')   # placeholder prefix - replace with actual KB IDs from MSRC
$kbHit = $false
foreach ($pat in $RequiredKBPatterns) { if ($hotfixes -match [regex]::Escape($pat)) { $kbHit = $true } }
$ubu = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install').LastSuccessTime
if ($kbHit) {
  Add-Finding 'Windows OS' $os.Caption $os.Version 'PATCHED (Sept 2026 CU present)' 'None'
} else {
  Add-Finding 'Windows OS' $os.Caption "Build $build" 'MISSING Sept 2026 CU - vulnerable to CVE-2026-81963/85880' 'Install latest cumulative update via WSUS/Windows Update'
  $exposed = $true
}

# ---------- 3. Quick exposure checks ----------
# ScreenConnect/RMM listening ports open to the world?
$listeners = Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -in 8040,8041,8042,8443,443,22,8080,8081,8082 }
foreach ($l in $listeners) {
  $fw = Get-NetFirewallRule -Direction Inbound -Action Allow | Where-Object {
    ($_.DisplayName -match 'Any|All|0.0.0.0') -and $_.Enabled -eq 'True'
  }
}

# RMM agent persistence artifacts (post-exploitation residue check)
$suspiciousRun = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' |
  Select-Object * | Out-String
foreach ($ind in 'screenconnect','n-central','takecontrol') {
  if ($suspiciousRun -match $ind) {
    Add-Finding 'Autoruns' 'HKLM\...\Run' $ind 'UNEXPECTED RMM AUTORUN - investigate for attacker-installed access' 'Review & remove if unauthorized'
    $exposed = $true
  }
}

# ---------- 4. Report ----------
$out = "C:\\ProgramData\\KEV-2026-09-Report-$(Get-Date -Format 'yyyyMMdd-HHmm').csv"
$report | Sort-Object Product | Format-Table -AutoSize
$report | Export-Csv -NoTypeInformation $out
Write-Host "`n[+] Report written to $out" -ForegroundColor Cyan
if ($exposed) {
  Write-Host '[!] EXPOSURE DETECTED - remediate per CISA KEV binding deadlines (BOD 22-01).' -ForegroundColor Red
  exit 1
} else {
  Write-Host '[OK] No vulnerable products detected on this host.' -ForegroundColor Green
  exit 0
}

Patch & Remediation Priorities

Priority 1 — Patch within 24–72 hours (pre-auth RCE / mass-exploitable edge & RMM):

CVE-2026-86218 — N-able N-central (pre-auth RCE on RMM; MSP blast radius). Apply the fixed N-central build per the N-able security advisory: https://www.n-able.com/security-advisories
CVE-2026-84869 — ConnectWise ScreenConnect (auth/privilege → endpoint RCE). Patch per ConnectWise Trust Center bulletin: https://www.connectwise.com/company/trust/security-bulletins — cloud instances are patched by ConnectWise; on-prem instances are your responsibility.
CVE-2026-19490 — Citrix NetScaler (auth bypass). Patch per Citrix security bulletin: https://support.citrix.com/support-home/kbsearch — then kill all sessions (kill icaconnection / Management UI) to evict stolen sessions.
CVE-2025-25249 — Fortinet FortiOS/FortiSwitchManager/FortiSASE (pre-auth overflow → RCE). Upgrade per Fortinet PSIRT: https://www.fortiguard.com/psirt. Workaround if patching is blocked: disable internet-facing administrative interfaces (disable admin access on WAN, restrict via local-in policy/trusted hosts).
CVE-2026-20079 — Cisco FMC/SCC (management-plane auth bypass). Patch per Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/publicationListing.x — audit FMC user accounts and recent policy commits.

Priority 2 — Patch within 1 week (supply chain / data theft): 6. CVE-2026-42016 + CVE-2026-42018 — JFrog Artifactory: Upgrade per https://jfrog.com/help/r/jfrog-security-advisories; rotate all API keys, tokens, and stored credentials; disable anonymous access if not required. 7. CVE-2026-85706 — GitLab CE/EE: Upgrade per https://about.gitlab.com/releases/categories/releases/; rotate CI/CD tokens, deploy keys, and secrets.yml material after patching. 8. CVE-2026-86060 + CVE-2026-67277 — MikroTik RouterOS: Update via https://mikrotik.com/download; restrict Winbox/API/SSH to management VLANs; disable unused services. Workaround: firewall management ports from untrusted networks immediately.

Priority 3 — Patch within standard cycle, accelerated (browser + LPE + e-commerce): 9. CVE-2026-87491 — Chromium V8: Enforce Chrome/Edge auto-update; verify fleet version ≥ the fixed build at https://chromereleases.googleblog.com/. 10. CVE-2026-81963 + CVE-2026-85880 — Microsoft Windows: Deploy the September 2026 cumulative updates via WSUS/Intune; prioritize servers and admin workstations (LPEs are second-stage payloads — their presence in KEV signals active intrusion chains). 11. CVE-2026-75650 — Adobe Commerce/Magento: Apply the Adobe security patch per https://helpx.adobe.com/security/security-bulletin.html; audit core_config_data, template files, and admin users for tampering.

Workarounds where patching is unavailable: isolate the vulnerable service behind a VPN or allowlisted reverse proxy; disable anonymous/unauthenticated access paths; apply vendor-published IPS/WAF signatures; and for MikroTik/Fortinet, remove management-plane exposure from the WAN entirely. Note that CISA BOD 22-01 directs agencies to discontinue use of products where mitigations cannot be applied — treat that as the standard for unmanaged edge devices.

CISA compliance: All 14 CVEs carry binding remediation due dates for federal civilian executive branch agencies under BOD 22-01 — typically three weeks from catalog addition (verify exact per-CVE due dates in the KEV catalog). Private-sector organizations should adopt the same deadlines as internal SLAs; cyber insurers increasingly audit against KEV remediation timelines.

Security Arsenal's SOC has deployed the detections above to all AlertMonitor customers. If you run ScreenConnect, N-central, NetScaler, or Fortinet on your perimeter, assume exposure until patch verification is complete.

Related Resources

Security Arsenal Penetration Testing Managed SOC & MDR AlertMonitor Platform From The Dark Side Intel Hub

CISA KEV Flash: 14 CVEs Added — ConnectWise, JFrog, GitLab & Citrix Under Active Attack