Security AffairsPierluigi Paganini
CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited
Part of the Artifactory story · since 1 Sep
- Tue 1 Sep, 06:40 UTC. SecurityOnline, first report. Critical JFrog Artifactory flaw lets attackers gain admin access. Cites a CVE in CISA KEV.
- Tue 1 Sep, 10:36 UTC. SecurityWeek, its first report on the story. Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild. Cites a CVE in CISA KEV.
- Tue 1 Sep, 18:36 UTC. The Hacker News, its first report on the story. Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure.
- Tue 1 Sep, 21:30 UTC. Dark Reading, its first report on the story. Attackers Pounce on Critical Artifactory Flaw Following Disclosure. Cites a CVE in CISA KEV.
- Thu 3 Sep, 13:30 UTC. SOCRadar, its first report on the story. JFrog Artifactory CVE-2026-82329 Exploited. Cites a CVE in CISA KEV.
- Tue 8 Sep, 13:19 UTC. Check Point, its first report on the story. ChatGPT Sandbox Flaw Let Attackers Steal Data Through Hidden Tasks.
- Fri 11 Sep, 01:30 UTC. SecurityOnline. JFrog Artifactory Flaws Exploited to Seize Admin Control. Cites a CVE in CISA KEV.
- Fri 11 Sep, 07:48 UTC. The Hacker News. Attackers Chain JFrog Artifactory Flaws to Seize Admin Control. Cites a CVE in CISA KEV.
- Fri 11 Sep, 20:32 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited JFrog Artifactory Flaw. Cites a CVE in CISA KEV.
- Fri 11 Sep, 20:32 UTC. CISA. CISA Warns of Exploited JFrog Artifactory Authentication Flaw. Cites a CVE in CISA KEV.
- Sat 12 Sep, 17:53 UTC. The Hacker News. CISA Flags Artifactory, ScreenConnect and RouterOS Attacks. Cites a CVE in CISA KEV.
- Mon 14 Sep, 09:36 UTC. SecurityWeek. Hackers Exploit JFrog Artifactory Bugs to Install Persistent Backdoors. Cites a CVE in CISA KEV.
- Mon 14 Sep, 15:26 UTC. Security Affairs, its first report on the story. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV. This article, 13th of 13.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect and GitLab to its Known Exploited Vulnerabilities (KEV) catalogue. The entries are CVE-2026-42016 (CVSS 8.1), CVE-2026-42018 (7.5), CVE-2026-84869 (9.9) and CVE-2026-85706 (10.0). The two Artifactory flaws can be chained to bypass authorisation, obtain an internal anonymous-user token and gain administrative control.
Wiz reported exploitation between 15 August and 8 September, including server takeovers, persistent administrator accounts, malicious plugins and backdoors.
CVE-2026-84869 affects the ScreenConnect client and, under certain conditions, allows files to be transferred and executed through an active remote session without host authorisation or confirmation. Huntress linked the vulnerability to incidents involving malicious VBScript payloads; ConnectWise recommends upgrading to ScreenConnect 26.6.5. GitLab’s CVE-2026-85706 is a path-traversal flaw in the repository commits API.
A crafted request can expose files including SSH keys, database credentials, deploy tokens and CI/CD variables. watchTowr reported in-the-wild probing by 11 September, and advised organisations with public-facing self-hosted GitLab installations to patch or remove public access. A POST request to `/api/v4/projects/{id}/repository/commits/` containing a `file.path` parameter may indicate exploitation.
Affected versions include Community Edition and Enterprise Edition releases from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. CISA set federal remediation deadlines of 14 September 2026 for the GitLab and ScreenConnect flaws, and 25 September 2026 for the Artifactory issues.
How the story developed
13 articles from 8 outlets since 1 Sep. Quiet since 14 Sep. This was the 13th report, 13 days after the first.
- Tue 1 Sep, 06:40 UTC. SecurityOnline, first report. Critical JFrog Artifactory flaw lets attackers gain admin access. Cites a CVE in CISA KEV.
- Tue 1 Sep, 10:36 UTC. SecurityWeek, its first report on the story. Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild. Cites a CVE in CISA KEV.
- Tue 1 Sep, 18:36 UTC. The Hacker News, its first report on the story. Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure.
- Tue 1 Sep, 21:30 UTC. Dark Reading, its first report on the story. Attackers Pounce on Critical Artifactory Flaw Following Disclosure. Cites a CVE in CISA KEV.
- Thu 3 Sep, 13:30 UTC. SOCRadar, its first report on the story. JFrog Artifactory CVE-2026-82329 Exploited. Cites a CVE in CISA KEV.
- Tue 8 Sep, 13:19 UTC. Check Point, its first report on the story. ChatGPT Sandbox Flaw Let Attackers Steal Data Through Hidden Tasks.
- Fri 11 Sep, 01:30 UTC. SecurityOnline. JFrog Artifactory Flaws Exploited to Seize Admin Control. Cites a CVE in CISA KEV.
- Fri 11 Sep, 07:48 UTC. The Hacker News. Attackers Chain JFrog Artifactory Flaws to Seize Admin Control. Cites a CVE in CISA KEV.
- Fri 11 Sep, 20:32 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited JFrog Artifactory Flaw. Cites a CVE in CISA KEV.
- Fri 11 Sep, 20:32 UTC. CISA. CISA Warns of Exploited JFrog Artifactory Authentication Flaw. Cites a CVE in CISA KEV.
- Sat 12 Sep, 17:53 UTC. The Hacker News. CISA Flags Artifactory, ScreenConnect and RouterOS Attacks. Cites a CVE in CISA KEV.
- Mon 14 Sep, 09:36 UTC. SecurityWeek. Hackers Exploit JFrog Artifactory Bugs to Install Persistent Backdoors. Cites a CVE in CISA KEV.
- Mon 14 Sep, 15:26 UTC. Security Affairs, its first report on the story. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV. This article, 13th of 13.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 13 articles as a listHide the list
- Tue 1 SepDay 04
- Critical JFrog Artifactory flaw lets attackers gain admin access06:40 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
- Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild10:36 · SecurityWeek · Known exploited CVE
- Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure18:36 · The Hacker News
- Attackers Pounce on Critical Artifactory Flaw Following Disclosure21:30 · Dark Reading · Known exploited CVE
Quiet for 2 days
Thu 3 SepDay 21Quiet for 5 days
Tue 8 SepDay 71- ChatGPT Sandbox Flaw Let Attackers Steal Data Through Hidden Tasks13:19 · Check Point · Picked up again
Quiet for 3 days
Fri 11 SepDay 104- JFrog Artifactory Flaws Exploited to Seize Admin Control01:30 · SecurityOnline · Picked up again · Known exploited CVE
- Attackers Chain JFrog Artifactory Flaws to Seize Admin Control07:48 · The Hacker News · Known exploited CVE
- CISA Warns of Actively Exploited JFrog Artifactory Flaw20:32 · CISA · official · CISA alert · Known exploited CVE
- CISA Warns of Exploited JFrog Artifactory Authentication Flaw20:32 · CISA · official · Known exploited CVE
- Sat 12 SepDay 111
- CISA Flags Artifactory, ScreenConnect and RouterOS Attacks17:53 · The Hacker News · Known exploited CVE
Quiet for 2 days
Mon 14 SepDay 132- Hackers Exploit JFrog Artifactory Bugs to Install Persistent Backdoors09:36 · SecurityWeek · Known exploited CVE
- CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited15:26 · Security Affairs · Known exploited CVE · This article, 13th of 13