Five Flaws Added to KEV in One Entry (09/13/2026)

Three products landed in the Known Exploited Vulnerabilities catalog together this week, and the thing they have in common is worth more attention than any one of the flaws. An artifact repository, a remote support tool, and a router operating system are all infrastructure that sits underneath other work, which is why each of them reaches further than its own footprint suggests.

Top 5 Critical Security Alerts

1. CISA Adds Five Exploited Flaws Across Three Products

CISA added five actively exploited vulnerabilities to the KEV catalog covering JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS, following reports of exploitation in the wild. We have covered all three separately in the past fortnight, and seeing them arrive as one batch is the useful signal, since it says the same opportunistic pressure is being applied across every layer somebody can reach from outside. The KEV listing also converts each one from a vendor advisory into a deadline for federal agencies and a defensible priority for everybody else. The Hacker News has the catalog additions.

Operator Note: Check all three even if you believe you patched, because Artifactory, ScreenConnect, and RouterOS are commonly administered by three different teams and nobody owns the overlap.

2. Microsoft Details Passkey-Themed Cloud Account Takeovers

Microsoft disclosed two campaigns, one sending large volumes of financial fraud messages through third-party email delivery infrastructure and one using passkey-themed social engineering to breach cloud environments and exfiltrate data. Passkeys are the control most organizations are actively rolling out right now, which makes an email about setting one up both expected and urgent in exactly the way an attacker needs. The pretext borrows its credibility directly from your own security program, which is the part you cannot warn people away from without undermining the rollout. The Hacker News has both campaigns.

Operator Note: Tell your users now, in plain language, exactly how your passkey enrollment will reach them and what it will never ask for, because the rollout announcement is the thing being impersonated.

3. A Sogou Input Method Flaw Is Delivering GrayRabbit

A China-aligned espionage group is exploiting CVE-2026-51990, a critical flaw in Tencent’s Sogou Input Method for Windows, to install the GrayRabbit backdoor. An input method editor runs with access to everything a person types, which makes it among the most sensitive software on a machine and among the least likely to appear in an asset inventory. Anybody with Chinese-language users has this class of software deployed somewhere whether or not IT installed it. BleepingComputer has the campaign.

4. Obscurity Has Stopped Buying Time

Analysts make the case that whatever protection came from a system being unusual, undocumented, or simply not worth anybody’s attention is now gone, because the cost of understanding an unfamiliar target has collapsed. Plenty of real environments have depended on obscurity without anybody writing it down, particularly the custom application nobody has looked at since the person who built it left. That defense was always an accounting of attacker effort, and the accounting changed. The Register has the argument.

Operator Note: List the systems you have quietly been protecting by their strangeness, then treat that list as a backlog rather than as an inventory.

5. AI Tool Activity Is the Fastest Growing Alert Category

Security operations teams report that alerts triggered by ordinary AI tool and agent activity are growing faster than any other class in the stream, and these are the everyday footprint of a company using the technology rather than attacks against it. A detection pipeline tuned before this existed reads legitimate agent behavior as anomalous, because in a real sense it is. Left alone, the ratio of alerts a human never needed to see keeps climbing until the queue stops being read carefully. The Hacker News has the analysis.

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.