Today’s Field Note

Two things demand attention before the coffee cools. CISA added five bugs to KEV under confirmed active exploitation, spanning JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS (starting with CVE-2026-42016, an authorization bypass). ScreenConnect and RouterOS are perennial favorites for initial access and persistence, so treat those as live intrusions in progress until proven otherwise. Separately, the Dutch NCSC says exploitation of two critical Check Point VPN flaws, CVE-2026-85102 and CVE-2026-85103, is imminent, which in NCSC-speak means someone already has working exploit code and the clock is public. Internet-facing gateways and remote-access tooling are the theme today, and none of these wait for your change-management window.

Today’s Action

  • Patch Check Point VPN gateways for CVE-2026-85102 and CVE-2026-85103 now, or restrict management and VPN portals to known IPs if you cannot patch immediately.
  • Update ConnectWise ScreenConnect and MikroTik RouterOS to fixed versions; both appear in the new KEV additions with active exploitation.
  • Patch JFrog Artifactory for CVE-2026-42016 and audit for unauthorized package pulls or pushes that predate the fix.
  • Hunt for compromise on all four products: review ScreenConnect access logs, RouterOS scheduler and user accounts, and VPN auth logs for anomalous sessions before you patched.
  • Pull any exposed management interfaces for these devices off the public internet as a standing rule, not a one-off.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

The exploits shipped before your ticket did.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.