The U.S This article explores screenconnect distribute malicious. . Cybersecurity and Infrastructure Security Agency (CISA) has identified five security vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS and has added them to its Known Exploited Vulnerabilities (KEV) catalog.
CVE-2026-84869 (ConnectWise ScreenConnect) - A missing privilege management and authorization oversight that allows unauthorized file transfers and remote session execution via an active session without proper authorization or host confirmation. The vulnerability, CVE-2026-82329, has been added to CISA's KEV catalog this month.
"Observed post-exploitation activity includes the creation of persistent administrator accounts, the deployment of malicious Groovy plugins for code execution, and the installation of Rust-based backdoors to establish persistence." The exploitation of CVE-2026-84869 has been linked to a set of three unrelated incidents documented by Huntress, where threat actors abused ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. "Under certain circumstances, this could enable files to be transferred to and executed on the Host client system, including through elevated execution actions," Huntress said in an update, urging organizations to update to ScreenConnect version 26.6.5.
CISA added CVE-2026-67277 and CVE-2026-86060 following a report from CERT Polska last week, which disclosed that unknown threat actors were exploiting two vulnerabilities in MikroTik RouterOS to gain unauthorized access to vulnerable devices.
