Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-42018 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-11 |
| Vendor | JFrog |
| Product | Artifactory |
| CVSS Score | 7.5 (high) |
| EPSS Score | 0.9% (percentile: 59%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-25 |
Vulnerability Description
Source: CISA KEV
JFrog Artifactory contains an improper authentication vulnerability through which the application may return an internal anonymous-user token to a caller that has not authenticated. The result is potential exposure of sensitive resources.
The condition under which this happens is what matters most: it occurs even when anonymous access has been disabled. In other words, a safeguard the administrator deliberately turned on does not protect here — the configuration looks correct, yet the token is still issued. Reviewing settings will therefore not reveal the problem; only the software version decides.
Artifactory serves as the repository for artifacts and packages in CI/CD pipelines. Unauthorised access to its contents means visibility into internal libraries and images, and in some configurations into credentials embedded in artifacts.
The entry appears in the CISA KEV catalog as actively exploited, and the assigned remediation deadline of 2026-09-25 has passed.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects organisations running JFrog Artifactory.
Do not base your assessment on the anonymous-access setting — that is precisely what fails here. Check your instance version against the vendor advisory. Note as well the second vulnerability from the same period, CVE-2026-42016, concerning token scope validation in the same product.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
