CVE-2026-42016, CVE-2026-42018, CVE-2026-67277, CVE-2026-82329, CVE-2026-84869, CVE-2026-85046, CVE-2026-85880, CVE-2026-86060, CVE-2026-87491
Get tomorrow's brief in your inbox
Today: CISA added five actively exploited flaws to the KEV catalog with patch deadlines through September 25, including Artifactory bugs chained for admin takeover and a ScreenConnect flaw enabling unauthorized file execution. Chinese APT groups deployed a new exploit kit called BlueMoon that chains three zero-days in Chrome and Windows, spreading across multiple espionage operations within days. Google leaked identifying information for sex crime victims globally through its content removal request system.
CISA Adds Five Actively Exploited Vulnerabilities to KEV Catalog
CISA added five flaws affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to the Known Exploited Vulnerabilities catalog following confirmed active exploitation. The Artifactory vulnerabilities (CVE-2026-42016, CVE-2026-42018) are being chained with CVE-2026-82329 to bypass authentication, escalate privileges, and gain admin control over self-hosted instances. Attackers deployed persistent admin accounts, malicious Groovy plugins, and Rust-based backdoors between August 15 and September 8, 2026. The ScreenConnect flaw (CVE-2026-84869, CVSS 9.9) allows file transfer and execution through active remote sessions without authorization. MikroTik flaws (CVE-2026-67277, CVE-2026-86060) enable kernel memory disclosure and privilege escalation without authentication, exploited in attacks CERT Polska calls "MikroTrick."
BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880)
Chinese APT group Violet Typhoon (APT31) deployed a new exploit kit called BlueMoon on August 28, chaining three zero-days for sandbox escape and privilege escalation. CVE-2026-85046 and CVE-2026-87491 are Chrome V8 engine flaws (patched September 3 and 8), and CVE-2026-85880 is a Windows ALPC privilege escalation (patched September 10). The kit fingerprints the host, injects a CreateProcess stub into the Chrome broker process, downloads an executable via curl, and executes it. Within days, three additional China-linked groups (UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) adopted BlueMoon in attacks targeting US aerospace, NGOs, manufacturing in Vietnam, and government/financial entities in Indonesia and Singapore. Development artifacts suggest possible AI assistance in building the exploit kit.
Google Content Removal System Leaked Sex Crime Victim Identities Globally
Google's content removal request system exposed identifying information for sex crime victims who submitted requests to remove illegally obtained sexual images. The leak affected victims globally, not just in South Korea where it was initially reported. Victims who requested removal of non-consensual intimate imagery had their private information posted online through flaws in Google's takedown process.
New York DFS Issues Cybersecurity Risk Assessment Guidance
The New York State Department of Financial Services issued new cybersecurity guidance outlining expectations for DFS-regulated entities conducting risk assessments. The guidance covers requirements for scope, frequency, and how risk assessments should inform cybersecurity programs for financial services organizations.
CVE-2026-42016 (CVSS 8.1) - JFrog Artifactory incorrect authorization, token scope validation bypass enables privilege escalation. CISA KEV due September 25. EPSS 0.009 (57th percentile).
CVE-2026-42018 (CVSS 7.5) - JFrog Artifactory improper authentication, returns internal anonymous-user token when anonymous access disabled, leaks sensitive resources. CISA KEV due September 25. EPSS 0.009 (58th percentile).
CVE-2026-82329 (CVSS 9.8) - JFrog Artifactory authentication bypass, chained with above flaws for admin control. CISA KEV due September 5. EPSS 0.077 (94th percentile).
CVE-2026-84869 (CVSS 9.9) - ConnectWise ScreenConnect improper privilege management, allows file transfer and execution through active session without host confirmation. CISA KEV due September 14. EPSS 0.007 (51st percentile).
CVE-2026-67277 (CVSS 8.8) - MikroTik RouterOS missing authentication in btest service, enables kernel memory disclosure and denial-of-service. CISA KEV due September 13. EPSS 0.009 (56th percentile).
CVE-2026-86060 (CVSS 9.2) - MikroTik RouterOS improper neutralization of argument delimiters, allows changing trusted policy mask for privilege escalation. CISA KEV due September 13. EPSS 0.010 (61st percentile).
CVE-2026-85046 - Chrome V8 engine flaw, patched September 3 as zero-day, exploited by BlueMoon kit for sandbox escape. CISA KEV due September 18. EPSS 0.013 (68th percentile).
CVE-2026-87491 - Chrome V8 engine flaw, patched September 8 as zero-day, exploited by BlueMoon kit for sandbox escape. CISA KEV due September 23. EPSS 0.009 (56th percentile).
CVE-2026-85880 - Windows ALPC privilege escalation, patched September 2026 Patch Tuesday as zero-day, exploited by BlueMoon kit. CISA KEV due September 22. EPSS 0.006 (46th percentile).
The BlueMoon exploit kit's rapid proliferation across multiple Chinese APT groups within days signals a reduced barrier to entry for advanced exploit capabilities, potentially AI-accelerated. CISA's addition of nine actively exploited vulnerabilities to the KEV catalog in the first two weeks of September reflects an elevated threat landscape requiring aggressive patch timelines.