# When the Build Pipeline, the Help Desk Tool, and the Router All Have Open Doors
Five vulnerabilities. Three product categories that, taken together, map almost perfectly onto how sophisticated threat actors move through an organization. CISA's latest addition to the Known Exploited Vulnerabilities catalog isn't routine housekeeping — it's a snapshot of active campaigns hitting the infrastructure layer most enterprises treat as trusted.
The additions cover flaws in JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. Federal agencies now have three weeks to patch or pull affected systems from the network. The rest of the industry doesn't have that deadline, which historically means many of them won't move at all until something breaks.
## Three Attack Surfaces, One Coherent Strategy
Look at this KEV batch as a single picture and a pattern emerges.
Artifactory sits at the center of the modern software supply chain. It's the artifact repository — the place where build pipelines pull dependencies, store compiled binaries, and push container images before they hit production. An attacker with a foothold in Artifactory isn't just inside one server. They're positioned to poison artifacts that get deployed everywhere the build pipeline reaches. That's not a lateral movement problem; that's a multiplication problem.
ScreenConnect is how managed service providers touch their clients. MSPs use it to push updates, run remote sessions, and troubleshoot endpoints across dozens or hundreds of customer networks. ConnectWise's platform has been under sustained assault since the authentication bypass vulnerabilities disclosed in early 2024 — CVE-2024-1709 saw exploitation within hours of public disclosure, setting a grim precedent. Whatever the current additions are, they land in a product that threat actors have already proven they'll weaponize fast. Compromising an MSP's ScreenConnect instance is a skeleton key: one breach, many client networks.
RouterOS runs on MikroTik hardware that's everywhere — in ISP last-mile infrastructure, branch office networking, small businesses, and home labs. The Meris botnet, which set DDoS records in 2021, ran on compromised MikroTik devices. More recently, nation-state actors have used RouterOS implants for long-term persistent access to network chokepoints that most organizations don't monitor with the same rigor they apply to endpoints.
Three different products. Three different entry points. Each one represents a trust boundary that defenders tend to under-scrutinize because they're categorized as infrastructure, not "real" attack surface.
## What Active Exploitation Actually Means Here
CISA doesn't add vulnerabilities to KEV on suspicion. The catalog requires evidence of active exploitation in the wild. That means, right now, someone's toolchain is hitting at least some of these flaws against real targets.
For Artifactory, the risk profile depends on which specific CVEs made the list, but the general class of Artifactory vulnerabilities — path traversal, remote code execution, access control bypasses — all translate directly to supply chain compromise. An attacker who can write to your artifact repository can slip malicious packages into builds that your own CI/CD pipeline will cheerfully sign and deploy.
For ScreenConnect, the exploitation pattern from earlier this year is instructive. Threat actors moved from proof-of-concept to mass exploitation in under 48 hours when the February 2024 critical bypass dropped. They weren't targeting specific organizations — they were scanning broadly, planting webshells, and sorting through whatever they found. The organizations that got hit hardest were the ones that assumed their vendor would push updates automatically or that their MSP had patched their own tools.
For RouterOS, exploitation tends to be quieter and longer-lived. Implants on network devices survive endpoint detection, don't show up in EDR telemetry, and persist through employee turnover and incident response cycles that focus on Windows hosts. The attackers who bother with RouterOS aren't looking for a quick ransomware payout — they're building infrastructure for persistent access or traffic interception.
## The Patch Calculus for Overloaded Security Teams
The three-week FISMA deadline for federal agencies is a forcing function that most private sector organizations lack. If your team is triaging this against a backlog of other critical CVEs, here's the ordering logic:
Patch ScreenConnect first if you're an MSP or if you use one. The blast radius of a compromised MSP RMM tool is enormous. If your managed services provider hasn't confirmed they're current on ConnectWise patches, ask explicitly — then verify.
Artifactory patches are non-negotiable for any organization with a functioning CI/CD pipeline. The question isn't just whether you're vulnerable to external attack — it's whether an attacker who already has any network access can reach your build infrastructure. Segment it if you can't patch immediately.
RouterOS requires an audit, not just a patch. MikroTik devices don't always get included in standard patch management tooling. Run a network discovery sweep specifically looking for MikroTik hardware. Check firmware versions. Look for configuration changes you didn't make. RouterOS compromises often leave no obvious signs — the device keeps routing traffic perfectly while forwarding copies of it elsewhere.
---
## HackWire Analysis
What makes this KEV batch worth paying close attention to isn't the individual vulnerabilities — it's what they collectively reveal about where active threat actors are currently investing.
The combination of a supply chain target (Artifactory), an MSP pivot point (ScreenConnect), and network infrastructure (RouterOS) isn't accidental. These three attack surfaces represent a mature intrusion playbook: compromise the software build system to poison downstream deployments, compromise the management tooling to jump client networks, and own the routers to ensure persistent access that survives detection and remediation of the endpoint-layer implants.
We've seen this layered approach from sophisticated actors before — most clearly in the SolarWinds campaign, which also threaded through build systems and IT management tools before hitting actual targets. The difference is that SolarWinds required nation-state resources and a patient, multi-year operation. The current exploitation of ScreenConnect and similar RMM tools is opportunistic and high-volume. The barrier to executing this kind of layered infrastructure attack has dropped.
The detail most coverage is missing: Artifactory is frequently excluded from vulnerability scanning programs because it's treated as a developer tool rather than production infrastructure. Security teams that scan their web applications and endpoints religiously often have no coverage on their artifact repositories. That's a significant blind spot, and threat actors demonstrably know it.
For defenders, the immediate action isn't just patching — it's auditing who has write access to Artifactory repositories and whether artifact integrity is being verified at deployment time. Patch the vulnerability, yes. But also close the architectural gap that makes a successful exploit catastrophic rather than merely bad.
— HackWire Editorial
---
## Related Coverage