CVE-2026-42018

What is CVE-2026-42018?

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Timeline

• 2026-08-12Published to the U.S. National Vulnerability Database (NVD)
• 2026-09-11Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
• 2026-09-12First covered in a defend.network daily briefing
• 2026-09-25CISA federal remediation deadline (BOD 22-01)
• 2026-10-23NVD record last updated

CISA Known Exploited Vulnerability

JFrog Artifactory Improper Authentication Vulnerability

Affected product

JFrog Artifactory

References

• https://docs.jfrog.com/releases/docs/jfrog-security-advisories
• https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
• https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
• https://nvd.nist.gov/vuln/detail/CVE-2026-42018
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Referenced in our briefings & reports

• Microsoft 974 patches, GitLab CVSS 10 exploited, Russia weaponizes Claude (2026-09-13)
• GitLab CVSS 10 exploited in wild; Microsoft ships 974 patches; Claude abused by state actors (2026-09-12)

Related vulnerabilities

• CVE-2026-82329 – JFrog Artifactory (same product)
• CVE-2026-66384 – JFrog Artifactory (same product)
• CVE-2026-42016 – JFrog Artifactory (same product)
• CVE-2026-105133 – Ahsay AhsayCBS (same weakness: CWE-287)
• CVE-2026-65400 – Apple MacOS (same weakness: CWE-287)
• CVE-2026-15981 (same weakness: CWE-287)