Verified status as of September 12, 2026
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-85706 in GitLab Community Edition and Enterprise Edition is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-09-11; federal remediation due 2026-09-14). NVD rates it 10 (CRITICAL) on CVSS v3.1.
- CVE-2026-42016 in JFrog Artifactory is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-09-11; federal remediation due 2026-09-25). NVD rates it 8.8 (HIGH) on CVSS v3.1. NVD lists a vendor advisory.
- CVE-2026-42018 in JFrog Artifactory is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-09-11; federal remediation due 2026-09-25). NVD rates it 7.5 (HIGH) on CVSS v3.1. NVD lists a vendor advisory.
- CVE-2026-84869 in ConnectWise ScreenConnect is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-09-11; federal remediation due 2026-09-14). NVD rates it 9.9 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory.
TL;DR
GitLab CVSS 10.0 path-traversal flaw exploited in-the-wild within hours of disclosure; Microsoft shipped 974 patches including multiple exploited Windows CVEs; AI abuse escalates with Russian state actors rebuilding malware via Claude and Chinese labs conducting industrial-scale model theft.
Executive Summary
- GitLab Community and Enterprise Editions face immediate risk from CVE-2026-85706, a maximum-severity (CVSS 10.0) unauthenticated path-traversal flaw in the repository commits API that allows arbitrary file reads. In-the-wild exploitation began within hours of public disclosure.
- Microsoft released its largest patch batch ever—974 vulnerabilities—addressing multiple actively-exploited Windows flaws, though AI-assisted vulnerability discovery is accelerating the pace of future disclosures.
- Anthropic disrupted multiple coordinated threat campaigns: a Russian state-sponsored group (GTG-20006) using Claude to automate malware rebuilding post-detection; seven Chinese AI labs conducting industrial-scale Claude model distillation; and financially-motivated gangs leveraging Claude to extract secrets from 1.8M Android apps.
- JFrog Artifactory authentication and authorization flaws (CVE-2026-42016, CVE-2026-42018) are being chained in active attacks to deploy Rust backdoors on self-hosted instances.
- ConnectWise ScreenConnect privilege management vulnerability (CVE-2026-84869) added to CISA KEV catalog with September 14 remediation deadline.
Top Threats Today
1. GitLab Path Traversal Exploited in Wild; Patches Released
Severity: CRITICAL Affected: Technology
GitLab Community Edition and Enterprise Edition contain a maximum-severity path traversal vulnerability (CVE-2026-85706, CVSS 10.0) in the repository commits API that allows unauthenticated attackers to read arbitrary files on affected servers [1][3]. In-the-wild exploitation probes were observed within hours of public disclosure ⚠[1]. The flaw stems from improper path confinement and missing authentication enforcement [3]. CISA added this CVE to its Known Exploited Vulnerabilities catalog on September 11, 2026, with a federal remediation deadline of September 14 [3].
Sources:[1] The Hacker News[2] The Hacker News[3] CISA KEV
Recommended Action
- Apply GitLab patches immediately to Community and Enterprise Edition instances; verify no unauthorized file access in logs
- Audit repository commits API logs for anomalous requests since August 2026
- If unable to patch within 48 hours, disable or restrict network access to the commits API endpoint
- Monitor CISA directives for critical mitigation steps
2. Microsoft Releases Record 974-Patch Update; Multiple Windows CVEs Already Exploited
Severity: HIGH Affected: Technology
Microsoft issued its largest single patch batch ever, addressing 974 security vulnerabilities across Windows operating systems and related software [1]. The update includes fixes for multiple CVEs that security experts warn are at elevated risk of exploitation, though the release notes do not specify how many are ⚠ currently under active attack [1]. Microsoft's statement notes that artificial intelligence is helping to accelerate vulnerability discovery, signaling that patch cadence may increase further [1].
Sources:[1] Krebs on Security
Recommended Action
- Prioritize patching based on CVSS score and asset criticality; Windows systems should be first
- Test patches in non-production environments before widespread deployment
- Monitor for exploitation attempts targeting newly-patched CVEs in the 48 hours post-deployment
- Enable Windows Update for automated distribution if organization policy permits
3. Russian State Hackers Use Claude for Malware Rebuilding; Chinese Labs Conduct Industrial-Scale Distillation Theft
Severity: HIGH Affected: Defense
Anthropic identified and disrupted a campaign by Russian state-sponsored cyber-espionage group GTG-20006 that leveraged Claude to automate workflows for rebuilding malware after detection, enabling the threat actor to stay ahead of detection curves [3][4]. The same period saw Anthropic disrupt industrial-scale illicit distillation attacks from seven China-based AI labs including Alibaba, Moonshot, DeepSeek, Z.ai (Zhipu), and MiniMax, which were extracting Claude model knowledge at production scale [1]. Additionally, Anthropic warned that cybercriminals and state-sponsored hackers have abused Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026 ⚠[2]. The Russia-linked campaign targeted more than 20 government, intelligence, diplomatic, and defense organizations [4].
Sources:[1] The Hacker News[2] The Hacker News[3] The Hacker News[4] The Record
Recommended Action
- Audit logs for any employee use of public AI platforms (Claude, ChatGPT, etc.) when accessing or analyzing sensitive networks or code
- Implement or strengthen policies restricting use of third-party AI services on corporate networks and classified systems
- Monitor for signs of post-exploitation malware rebuilding; coordinate with endpoint detection and response (EDR) teams on behavioral detection of regenerated malware families
- Brief security teams and threat intelligence on GTG-20006 TTPs; share IOCs with federal agencies if applicable
4. JFrog Artifactory Authentication Flaws Chained in Active Attacks; Rust Backdoor Deployed
Severity: HIGH Affected: Technology
Threat actors are actively exploiting multiple critical and high-severity authentication and authorization vulnerabilities in JFrog Artifactory to chain attacks and gain administrative control on self-hosted instances [1]. CVE-2026-42016 (incorrect authorization allowing privilege escalation due to improper token scope validation) and CVE-2026-42018 (improper authentication returning anonymous-user tokens when anonymous access is disabled) are being combined to bypass authentication and achieve admin access [2][3]. Following successful authentication bypass, attackers deploy a Rust-based backdoor for persistent access [1]. Both flaws were added to CISA's Known Exploited Vulnerabilities catalog on September 11, with a federal remediation deadline of September 25 [2][3].
Sources:[1] BleepingComputer[2] CISA KEV[3] CISA KEV
Recommended Action
- Immediately patch self-hosted Artifactory instances; check vendor advisory for specific version requirements
- Audit Artifactory logs for unauthorized file access, token generation, or admin privilege escalation since August 2026
- Reset all repository authentication tokens and review access controls post-patch
- Inspect running processes for Rust-based backdoor signatures; coordinate with threat intelligence for IOCs
5. ConnectWise ScreenConnect Privilege Flaw Added to CISA KEV; MikroTik RouterOS Exploited
Severity: HIGH Affected: Technology
ConnectWise ScreenConnect contains both improper privilege management and missing authorization vulnerabilities (CVE-2026-84869) that allow attackers to conduct file transfer and code execution through active remote sessions without authorization or user confirmation [1]. CISA added this CVE to its Known Exploited Vulnerabilities catalog on September 11, with a federal remediation deadline of September 14 [1]. Separately, MikroTik RouterOS was added to the KEV catalog (CVE-2026-86060) for an improper neutralization of argument delimiters vulnerability allowing privilege escalation and policy mask modification, with a September 13 remediation deadline [2].
Sources:[1] CISA KEV[2] CISA KEV
Recommended Action
- Update ConnectWise ScreenConnect and MikroTik RouterOS to patched versions by the federal remediation deadlines
- Review audit logs for unauthorized remote session activity on ScreenConnect instances
- Isolate RouterOS devices on restricted networks if patches are delayed; enforce network segmentation
- Verify no unauthorized policy changes have been made to RouterOS configurations
Today’s Action Checklist
- ☐ URGENT (within 24 hours): Patch GitLab Community and Enterprise Edition instances to remediate CVE-2026-85706 or disable repository commits API access if patching is not immediately possible.
- ☐ URGENT (within 24 hours): Stage Microsoft Windows patches from the 974-vulnerability release in test environments; prioritize critical and high-severity CVEs with public exploits.
- ☐ URGENT (within 48 hours): Patch JFrog Artifactory self-hosted instances (CVE-2026-42016, CVE-2026-42018) and reset all repository tokens and credentials.
- ☐ HIGH (by Sept 14): Update ConnectWise ScreenConnect to patched version and audit remote session logs for unauthorized access.
- ☐ HIGH (by Sept 13): Update MikroTik RouterOS devices and review policy configurations for unauthorized changes.
- ☐ ONGOING: Brief security teams on Claude abuse by state and criminal actors; restrict employee use of public AI services on corporate and classified networks; coordinate IOC sharing with threat intelligence partners.