CVE-2026-42016 and 4 More: CISA KEV Adds Actively Exploited JFrog Artifactory, ScreenConnect, and MikroTik RouterOS Flaws — Detection and Remediation Guide

---
title: ScreenConnect Client Spawning Command Interpreter or Scripting Engine
id: 3f8a2c41-7b1e-4d59-a2c6-9e1f4b7d8a30
status: experimental
description: Detects the ConnectWise ScreenConnect client service spawning command shells, scripting engines, or download utilities. Post-exploitation of ScreenConnect flaws routinely hands attackers an interactive session, observable as the client service parent process launching cmd, PowerShell, or LOLBins on managed endpoints.
references:
  - https://thehackernews.com/2026/09/cisa-adds-5-actively-exploited.html
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate technician remote sessions — validate against change tickets and ScreenConnect session logs for the host and time window
level: high
---
title: Suspicious JFrog Artifactory API Access Patterns
id: 8c4d1e92-6a3f-4b27-9d05-2f7c8e1a4b96
status: experimental
description: Detects web requests to Artifactory endpoints associated with administrative and security configuration functions from user agents inconsistent with normal CI/CD tooling. Incorrect authorization flaws (CWE-863, e.g. CVE-2026-42016) are exercised with syntactically valid requests, so detection focuses on sensitive endpoint access paired with anomalous clients rather than exploit payloads.
references:
  - https://thehackernews.com/2026/09/cisa-adds-5-actively-exploited.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/artifactory/api/security/'
      - '/artifactory/api/system/'
      - '/ui/api/v1/ui/auth/'
      - '/artifactory/api/repositories'
  selection_method:
    cs-method:
      - 'PUT'
      - 'POST'
      - 'DELETE'
  filter_known_clients:
    cs-user-agent|contains:
      - 'JFrog'
      - 'Artifactory'
      - 'jfrog-cli'
      - 'Maven'
      - 'Gradle'
      - 'docker'
      - 'npm'
  condition: selection_uri and selection_method and not filter_known_clients
falsepositives:
  - Administrators using the REST API from scripts with generic agents (curl/python-requests) — baseline and allow-list known admin source IPs
level: medium
---
title: MikroTik RouterOS Account or Configuration Change Followed by Egress Connection
id: 5b2e7a14-3d9c-4f81-b6e0-1c4a9d2f7e53
status: experimental
description: Detects Windows endpoints establishing outbound connections to MikroTik management services (Winbox 8291, SSH, API 8728/8729) from hosts that are not known network administration stations. Post-exploitation of RouterOS flaws frequently involves operators or tooling connecting back to reconfigure the device, create users, or pull credentials.
references:
  - https://thehackernews.com/2026/09/cisa-adds-5-actively-exploited.html
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.lateral_movement
  - attack.t1021
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort:
      - 8291
      - 8728
      - 8729
  filter_admin_hosts:
    Image|endswith:
      - '\winbox.exe'
  condition: selection_port and not filter_admin_hosts
falsepositives:
  - Network management platforms polling RouterOS API ports — allow-list the management subnet
level: medium

let Lookback = 14d;
// Stage 1: ScreenConnect client service spawning shells or LOLBins
let ScreenConnectAbuse = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName in~ ("ScreenConnect.ClientService.exe", "ScreenConnect.WindowsClient.exe")
   or ProcessCommandLine has_any ("ScreenConnect")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe","certutil.exe","bitsadmin.exe","curl.exe")
| project SC_Time=Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName, ReportId;
ScreenConnectAbuse;
// Stage 2: Connections to MikroTik management ports from non-admin hosts
DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where RemotePort in (8291, 8728, 8729)
| where ActionType == "ConnectionSuccess"
| summarize Connections=count(), DistinctTargets=dcount(RemoteIP), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
| order by Connections desc;
// Stage 3: RouterOS syslog indicators of unauthorized config/user changes (requires Syslog/CEF forwarding)
Syslog
| where TimeGenerated > ago(Lookback)
| where SyslogMessage has_any ("user added", "logged in", "configuration changed", "script", "scheduler")
| where Computer has_any ("mikrotik", "routeros") or Facility == "system"
| project TimeGenerated, Computer, HostIP, SyslogMessage
| order by TimeGenerated desc;

-- Hunt for ScreenConnect client processes spawning execution tooling
-- and for established connections to MikroTik management ports
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)ScreenConnect'
   OR CommandLine =~ '(?i)screenconnect'

-- Correlate with live network connections to router management services
SELECT Pid, Name, Family, Type, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE RemotePort IN (8291, 8728, 8729, 22, 23)
  AND Status =~ 'ESTAB'
  AND RemoteAddress !~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)'  -- flag external router management

# --- ScreenConnect version and service inventory (Windows endpoints/servers) ---
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
                 HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match 'ScreenConnect|ConnectWise Control' } |
  Select-Object DisplayName, DisplayVersion, InstallDate | Format-Table -AutoSize

# Flag any ScreenConnect client service instances for version verification
Get-Service -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match 'ScreenConnect' } |
  Select-Object Name, DisplayName, Status, StartType

# Pull the binary version directly for comparison against the vendor's fixed release
Get-ChildItem 'C:\Program Files (x86)\ScreenConnect Client*',
              'C:\Program Files\ScreenConnect*' -Recurse -Filter *.exe -ErrorAction SilentlyContinue |
  Select-Object FullName, @{N='FileVersion';E={$_.VersionInfo.FileVersion}} | Format-Table -AutoSize

# --- Network sweep: which hosts can reach MikroTik management ports? ---
1..254 | ForEach-Object {
  $target = "192.168.1.$_"   # adjust subnet
  foreach ($port in 8291,8728,8729) {
    if (Test-NetConnection -ComputerName $target -Port $port -InformationLevel Quiet -WarningAction SilentlyContinue) {
      Write-Output "EXPOSED: $target : $port"
    }
  }
}

# --- JFrog Artifactory: confirm running version and recent admin-plane activity ---
# 1. Report the deployed version (compare against the fixed release in JFrog's advisory)
curl -s -u "${ARTIFACTORY_USER}:${ARTIFACTORY_TOKEN}" \
  https://artifactory.example.com/artifactory/api/system/version | jq .

# 2. Review access logs for security/admin API calls from non-CI sources (last 24h)
grep -E '/api/(security|system)/' /var/opt/jfrog/artifactory/log/access.log \
  | awk '{print $1, $6, $7, $8}' | sort | uniq -c | sort -rn | head -50

# 3. Hunt for artifact writes outside CI service accounts (potential poisoning)
grep -E 'PUT|DEPLOY' /var/opt/jfrog/artifactory/log/access.log \
  | grep -viE 'ci-service|jenkins|github-actions' | tail -100

# --- MikroTik RouterOS: version check and account/persistence audit (run via SSH) ---
ssh admin@router.example.com "/system resource print; /system package print"
ssh admin@router.example.com "/user print detail; /system scheduler print detail; /system script print detail"
# Disable unused management surfaces
ssh admin@router.example.com "/ip service disable api,api-ssl,ftp,telnet,www; /ip service set winbox address=10.0.99.0/24"