CVE-2026-42018
HIGHCVSS 3.1 · 7.5 · reefs@jfrog.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CISA KEV: known exploited
Added: 2026-09-11 · Due: 2026-09-25
Known ransomware use: Unknown
EPSS: 9.80% · Percentile: 95.5%
As of 2026-10-27
EPSS estimates exploitation probability over the next 30 days. KEV due dates apply to US federal civilian agencies. Confirm your affected versions in vendor advisories.
CWE: CWE-287 · Published: 2026-08-12T18:17:29.473 · Modified: 2026-10-23T19:10:00.167
Sources: NIST NVD, CISA KEV, FIRST EPSS. NVD and EPSS cached up to 6 hours; KEV up to 12 hours.
References and fixes
- https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018
- https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201