JFrog Artifactory and ConnectWise ScreenConnect vulnerabilities under active exploitation

The US Cybersecurity and Infrastructure Security Agency (CISA) has added five vulnerabilities to its Known Exploited Vulnerabilities catalogue, including three affecting JFrog Artifactory (CVE-2026-42016, CVE-2026-42018 and CVE-2026-85706) and one affecting ConnectWise ScreenConnect (CVE-2026-84869). The Register and The Hacker News report that all three JFrog vulnerabilities are being actively exploited in the wild, with patches available. The vulnerabilities involve incorrect authorisation, improper authentication and path traversal issues. CISA's inclusion of these flaws signals that exploitation is confirmed and organisations should treat patching as a priority. A fifth vulnerability affecting MikroTik RouterOS was also added to the catalogue.

Why this matters for UK organisations

JFrog Artifactory is widely used across UK software development and DevOps teams as a repository manager for build artefacts, container images and software dependencies. ConnectWise ScreenConnect is a remote access and support tool commonly deployed by managed service providers and internal IT teams. Both products sit in positions of significant trust within enterprise environments, making them attractive targets for attackers seeking to move laterally, access sensitive code, compromise supply chains or gain persistent remote access. The operational risk here is not theoretical: these vulnerabilities are being exploited now, and organisations using these platforms should assume that attackers are actively scanning for unpatched instances. For organisations that rely on managed service providers, this is also a supply chain concern: if your MSP uses ScreenConnect to manage your environment, you need assurance that they have patched their systems. The path traversal vulnerability in Artifactory is particularly concerning because it could allow attackers to access files outside the intended directory structure, potentially exposing source code, credentials or configuration files.

What to review

Organisations using JFrog Artifactory or ConnectWise ScreenConnect should confirm that patches have been applied immediately. If these platforms are managed by third parties, verify that your suppliers have acted and request confirmation of patch status. This is also an opportunity to review whether you have clear visibility of where these tools are deployed, who is responsible for maintaining them and whether vulnerability management processes are working as intended. For DevOps teams, consider whether Artifactory instances are appropriately segmented and whether access controls are configured to limit the potential impact of a compromise. For organisations using ScreenConnect, review whether remote access is appropriately restricted, logged and monitored. Finally, ensure that your vulnerability management process includes a clear escalation path for actively exploited vulnerabilities, so that patching can be prioritised and completed within a defined timeframe.

Source: The Register