Exploitation evidence puts two Artifactory auth flaws and a ScreenConnect privilege bug in KEV

A patch on an authentication flaw closes the path but leaves the question of who walked it earlier. BOD 26-04 puts that second job in writing: the directive establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied ^[8]. On these two products the look-back is bounded by whatever authorization logging was enabled and how long it was retained.

The weakness titles CISA assigned are access control, three for three: incorrect authorization on CVE-2026-42016, improper authentication on CVE-2026-42018, improper privilege management and missing authorization on CVE-2026-84869 ^{[3][4][5][14]}. Exploitation of that class is a run of well-formed requests to a service whose job is answering requests. The evidence sits in application and access logs, and it ages out on the retention schedule.

CISA's bar for adding an entry is a CVE ID, evidence of exploitation, and clear mitigation guidance ^[10]. All three cleared it. There is something to apply today for each one.

BOD 26-04 binds only Federal Civilian Executive Branch agencies, and CISA encourages every other organisation to adopt risk-based vulnerability management and prioritise KEV items ^[9]. The directive's top tier is publicly exposed assets that grant total control of the asset post-exploitation, and it allows deferring action on lower-risk vulnerabilities ^[7]. Whether a given host sits in that tier turns on two things an operator can check without waiting for CISA: is it reachable from the internet, and does exploitation hand over the box. An internal-only Artifactory can legitimately wait behind an exposed ScreenConnect server under the directive's own wording.

Two of the three CVEs are in one product, JFrog Artifactory ^[13]. That matters for inventory work: one vendor advisory covers two thirds of this batch, and the third needs a separate owner.

CISA did not name an actor, a date of first exploitation, or what exploitation reached beyond the affected host. The argument that these two products are the route to every downstream system therefore rests on where operators put them. The alert confirms exploitation, and the agency wrote that these types of vulnerabilities "are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise" ^[2][12].