HIGHVulnerability
Verified
Global

CISA KEV: JFrog Artifactory — JFrog Artifactory Improper Authentication Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Analysis

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. Added to CISA Known Exploited Vulnerabilities catalog on 2026-09-11. Remediation due: 2026-09-25.

Indicators of Compromise (1)

CVE (1)
CVE-2026-42018
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Sep 11, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerabilityNEW

China-Linked Hackers Impersonate AI Experts to Target US Policy Insiders

TA419 posed as AI policymakers and economists to phish US AI policy experts' Microsoft 365 accounts

Infosecurity Magazine
MEDIUMVulnerabilityNEW

Kiteworks patches max severity code injection vulnerability

Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution. [...]

BleepingComputer
MEDIUMVulnerabilityNEW

CloudSyncD MacOS Backdoor Hides Behind Fake Zoom Installer

CloudSyncD uses a fake Zoom installer to phish Mac passwords and launch a two-stage backdoor

Infosecurity Magazine