CVE-2026-42018

HIGH CISA KEV

ACT NOW Priority: 0.74 BB Relevance: 77/100

Published: 2026-08-12 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: None

S: Unchanged

C: High

I: None

A: None

Description

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

CISA Known Exploited Vulnerability

Vendor / Product JFrog — Artifactory

Date Added 2026-09-11

Remediation Due 2026-09-25

https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-42018

Weakness Classification (1)

CWE-287

Affected Software (5)

Vendor	Product	Version
jfrog	artifactory	< 7.111.20
jfrog	artifactory	7.117.0 – 7.117.27
jfrog	artifactory	7.125.0 – 7.125.19
jfrog	artifactory	7.133.0 – 7.133.28
jfrog	artifactory	7.146.0 – 7.146.8