Multi-Vector Exploitation Campaign Targets Critical Enterprise Infrastructure Components
In September 2026, CISA added five critical vulnerabilities to its Known Exploited Vulnerabilities catalog following reports of active exploitation targeting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS systems. Attackers have been chaining multiple Artifactory flaws (CVE-2026-42016, CVE-2026-42018) with previously disclosed CVE-2026-82329 to bypass authentication, escalate privileges, and deploy Rust-based backdoors on self-hosted servers between August and September 2026. Additional exploitation includes ScreenConnect client abuse for malicious VBScript distribution and MikroTik router compromises through the MikroTrick exploit chain targeting authentication bypass vulnerabilities. This incident highlights the accelerating trend of multi-vector exploitation campaigns where threat actors systematically chain vulnerabilities across enterprise infrastructure components to achieve comprehensive network compromise and establish persistent access.
Kill Chain
