In CISA KEV7.5 HighCWE-287
CVE-2026-42018
JFrog Artifactory Improper Authentication Vulnerability
jfrogartifactory
Status
- Exploited in the wild
- In CISA KEV since 11 Sep
- Vendor fix available
Federal deadlineFri 25 Sep, 23:59 UTC
Passed 30 days ago
CISA KEV · added 11 Sep
Exploit probabilityEPSSchecked 25 Oct
9.8%probability of exploitation in the next 30 days
Higher than 96% of scored CVEs
SeverityCVSS
7.5High
Description NVD
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage 7 articles · 5 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 11 Sep · 01:30 UTC | SecurityOnline | JFrog Artifactory Flaws Exploited to Seize Admin Control |
| Fri 11 Sep · 07:48 UTC | The Hacker News | Attackers Chain JFrog Artifactory Flaws to Seize Admin Control |
| Fri 11 Sep · 20:32 UTC | CISA | CISA Warns of Exploited JFrog Artifactory Authentication Flaw |
| Sun 13 Sep · 15:00 UTC | Security Affairs | Security Weekly Roundup Covers Cisco, Chrome and Windows Attacks |
| Sun 13 Sep · 18:30 UTC | Security Affairs | Security Affairs Tracks Malware, Ransomware and Active Exploits |
| Mon 14 Sep · 09:36 UTC | SecurityWeek | Hackers Exploit JFrog Artifactory Bugs to Install Persistent Backdoors |
| Mon 14 Sep · 15:26 UTC | Security Affairs | CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited |
- CISA Flags Artifactory, ScreenConnect and GitLab Flaws as ExploitedSecurity Affairs · mentions it in passing
- Hackers Exploit JFrog Artifactory Bugs to Install Persistent BackdoorsSecurityWeek
- Security Affairs Tracks Malware, Ransomware and Active ExploitsSecurity Affairs · mentions it in passing
- Security Weekly Roundup Covers Cisco, Chrome and Windows AttacksSecurity Affairs · mentions it in passing
- CISA Warns of Exploited JFrog Artifactory Authentication FlawCISA · official notice
- Attackers Chain JFrog Artifactory Flaws to Seize Admin ControlThe Hacker News
- JFrog Artifactory Flaws Exploited to Seize Admin ControlSecurityOnline · first in our coverage · mentions it in passing