CISA Adds Five Actively Exploited Vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA maintains the KEV catalog as a public, searchable database of vulnerabilities that have evidence of active exploitation. Unlike the broader National Vulnerability Database (NVD), which lists every reported flaw, the KEV catalog is curated to highlight threats that are already being weaponized by attackers in the field. When a vulnerability lands on this list, it moves from theoretical risk to confirmed incident activity. Organizations that rely on risk prioritization scores alone often find themselves patching the wrong things first; the KEV catalog is designed to cut through that noise.

The batch included vulnerabilities in three widely deployed software platforms. JFrog Artifactory, used for storing and managing software artifacts and dependencies in enterprise build pipelines, had authorization flaws that could allow attackers to bypass access controls. ConnectWise ScreenConnect, a remote access and support tool used by managed service providers and IT departments, contained issues that could lead to code execution. MikroTik RouterOS, the operating system for thousands of small office and branch routers globally, had exploitable weaknesses that expose network perimeters to direct compromise. Each flaw carried a CVSS severity score of 8.1 or higher, placing them in the critical range. The combination of ease of exploitation, high impact, and widespread deployment across all three products explains why attackers have already moved to active use.

A CVSS score of 8.1 tells you a vulnerability is serious; the KEV designation tells you it is already causing harm. When security teams see a flaw listed as actively exploited, it means incident response teams have documented real-world attacks, and threat intelligence feeds already contain proof-of-concept code or working exploits. This changes the urgency calculation entirely. A vulnerability with a 9.0 score that has no known exploit can sometimes wait; one with a 7.5 score on the KEV list cannot. Attackers typically publish detailed exploit code or proof-of-concept tools within days of the KEV listing, making delays exponentially more dangerous.

Artifactory vulnerabilities are often chained with lateral movement attacks. An attacker gains initial access through phishing or a weak credential, then exploits the authorization bypass to access software artifacts, inject malicious code into dependencies, and propagate compromises downstream to organizations that consume those artifacts. ScreenConnect flaws allow direct remote code execution, often leading to ransomware deployment or data exfiltration without additional steps. RouterOS exploits are particularly damaging because routers sit at network boundaries and are often overlooked in patching schedules; a compromised router can inspect, intercept, or redirect all traffic passing through it. In each case, the flaw requires little interaction from a user; the attacker simply connects to the vulnerable service and triggers the exploit automatically.

1. Check your asset inventory for any instance of JFrog Artifactory, ConnectWise ScreenConnect, or MikroTik RouterOS running in your network.
2. Verify the version number of each instance against the vendor security advisories to confirm whether you are affected.
3. Apply the latest security patches released by JFrog, ConnectWise, and MikroTik respectively, prioritizing exposed or internet-facing instances.
4. If immediate patching is impossible, implement network segmentation to restrict access to these services to trusted internal networks only.
5. Monitor CISA alerts and your vendor's security advisories daily for the next week, as additional related vulnerabilities often surface after the initial batch is revealed.

If you manage software supply chain tools like Artifactory, assume your build pipeline is at risk and review logs for any unauthorized access to artifact repositories. If you operate ScreenConnect sessions, check for unexpected remote sessions or new user accounts created during the active exploitation window.

CISA publishes KEV updates daily, and the list has grown substantially as attackers have become more methodical. Rather than waiting for news coverage, integrate CISA's KEV feed directly into your vulnerability management workflow. Most modern patch management and vulnerability scanning platforms can ingest the KEV catalog automatically and flag exploited flaws with higher urgency. The Tor Project, security vendors, and corporate security teams all monitor CISA announcements; law-enforcement and incident response firms often publish threat intelligence within hours of a KEV listing that includes indicators of compromise (IOCs) specific to real-world attacks. This is where the security ecosystem's transparency advantage over the attacker economy becomes visible; defenders have access to real-time threat data that makes response faster than the time it takes an attacker to weaponize and distribute an exploit widely.

The KEV catalog exists because vulnerabilities weaponized by attackers need different handling than theoretical flaws. The five additions flagged here represent imminent, not future, risk. Your patching decision should not depend on a CVSS score or a news headline; it should depend on whether the flaw is already being exploited, and CISA has already answered that question for you. Today, check whether your network runs any of these three products, and if it does, schedule patching for the next maintenance window or implement emergency network controls to contain the risk. Waiting for the next quarterly patch cycle is not an option once a flaw lands on the KEV list.

Source: The Hacker News