CISA has added four actively exploited vulnerabilities affecting self-managed GitLab, ScreenConnect clients, and JFrog Artifactory to its Known Exploited Vulnerabilities catalog. The GitLab and ScreenConnect entries carry a September 14 federal remediation deadline, so operators should patch now and perform the required forensic triage rather than treating an update as proof that an exposed system is clean.
What changed
The September 11 catalog update adds CVE-2026-85706, a GitLab repository-commits API path-traversal flaw that GitLab rates critical at CVSS 10.0. GitLab says an unauthenticated user could read arbitrary files from an affected server under certain conditions. Self-managed Community Edition and Enterprise Edition installations from 18.7 are affected unless they have moved to 19.1.8, 19.2.6, or 19.3.2. GitLab.com is already patched, and GitLab Dedicated customers do not need to act.
CISA also added CVE-2026-84869 in ScreenConnect. ConnectWise says an attacker with an active remote session could, in certain circumstances, transfer and execute files without authorization or host confirmation. The server component is not affected, but clients before 26.6.5 are. ConnectWise says no action is required for its cloud service; for upgraded deployments, it directs customers to reinstall host clients and update access agents, while on-premises operators must upgrade to 26.6.5.
The remaining entries, CVE-2026-42016 and CVE-2026-42018, affect self-hosted JFrog Artifactory. The first can let a valid token gain privileges because Artifactory checked its signature and issuer but not its scope; versions before 7.133.11 are affected. The second could return an internal anonymous-user token to an unauthenticated caller even when anonymous access was disabled. JFrog lists fixed releases for each maintained branch and says affected cloud environments have already been fortified.
The practical consequence
Internet-reachable self-managed GitLab installations have the most direct exposure: the catalog change adds confirmed exploitation to an unauthenticated arbitrary-file-read flaw, making the already available critical patch an emergency change. Files read from an application server can include configuration or other sensitive material, but the public sources do not say which files attackers obtained or whether the flaw by itself provides code execution.
ScreenConnect operators should make sure that both the service and deployed clients reach 26.6.5. If an immediate update is impossible, ConnectWise says administrators can temporarily remove the TransferFiles permission from every role, but calls that only a temporary mitigation. Because CISA marks both the GitLab and ScreenConnect entries for forensic triage, federal agencies must pair remediation with the agency’s evidence-preservation and review requirements.
Self-hosted Artifactory administrators should identify their release branch and apply JFrog’s corresponding fixed version rather than assuming that disabling anonymous access closes both paths. CISA gives those two entries until September 25, but confirmed exploitation makes the catalog an urgent prioritization signal for any exposed artifact repository.
Limits and evidence
CISA’s inclusion confirms exploitation of each CVE, but the catalog and vendor notices do not identify attackers, targets, victim counts, campaign scale, or initial-access chains. Ransomware use is listed as unknown for all four. ConnectWise’s issue requires an active remote session and additional access or circumstances; it is not a server-side unauthenticated takeover. JFrog Cloud and GitLab-hosted services have already been remediated according to their vendors, so the remaining operational burden is concentrated in self-managed deployments and client updates.
CVSS values are severity assessments, not performance measurements. No benchmark applies, and DrComps did not reproduce the vulnerabilities or exploitation. The affected-version and mitigation statements are vendor-supplied; organizations should verify their exact deployment, exposure, and client rollout state before declaring remediation complete.