The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five newly exploited perimeter vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The additions are headlined by MikroTrick—a zero-authentication exploit chain compromising MikroTik RouterOS devices—and a serious remote execution condition in ConnectWise ScreenConnect clients.

The disclosure follows technical advisories from national computer emergency response team CERT Polska and managed detection firm Huntress, highlighting how attackers are aggressively exploiting both edge routing appliances and remote support software.

Inside the MikroTrick Exploit Chain

According to CERT Polska, MikroTrick pairs two distinct defects in MikroTik RouterOS: CVE-2026-67277 and CVE-2026-86060. When chained together, an unauthenticated remote attacker can exploit memory management weaknesses in the router's communication daemon to achieve full system takeover:

  1. Unauthenticated Session Bypass: The attacker initiates malformed handshake packets against RouterOS management services (such as WinBox or the web interface).
  2. Memory Corruption & Privilege Escalation: Leveraging the secondary flaw, the attacker corrupts internal dispatch tables, executing arbitrary MIPS/x86 code with root privileges.
  3. Traffic Sniffing & Proxy Persistence: Compromised routers are converted into stealthy traffic proxies, routing criminal traffic and capturing cleartext transit packets across customer networks.

Silent VBScript Execution via ScreenConnect

In parallel, threat actors have begun weaponizing CVE-2026-84869 in ConnectWise ScreenConnect. Huntress documented three unrelated intrusions where adversaries exploited a client-side condition allowing files to be transferred and executed through an active remote support session without host confirmation or user authorization prompts.

Operators used the vulnerability to stage malicious Visual Basic Script (VBScript) loaders directly onto technician workstations, granting attackers persistent remote access to enterprise support consoles.

"Network gateways and remote support tools are the twin pillars of modern IT operations. Compromising either gives an adversary a direct, trusted highway into hundreds of internal network segments."

Immediate Remediation Steps

Network administrators should execute the following defensive actions immediately:

  • Patch MikroTik RouterOS: Update all RouterOS devices to the latest Stable or Long-term release branch (v7.15+), which resolves both CVE-2026-67277 and CVE-2026-86060.
  • Update ScreenConnect Clients: Ensure all ScreenConnect client and server instances are upgraded to release 26.6.5 or higher.
  • Block External Management Access: Close public WAN access to MikroTik WinBox (port 8291), WebFig (ports 80/443), and SSH (port 22). Access should be restricted strictly to IPsec/WireGuard administrative tunnels.