Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-42018 7.5
JFrog · Artifactory · Added 2026-09-11 · Published 2026-08-12
3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityJFrog Artifactory Improper Authentication Vulnerability
VendorJFrog
ProductArtifactory
Date added2026-09-11
Due date2026-09-25
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-287
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Descriptions

KEV: JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

NVD: JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impactpartial
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days
Non-public timeline14 days
Forensic (public)Not required
Forensic (non-public)Not required

Research metadata

Last researched2026-09-12 00:00 UTC
Searches5
Component defaultno
Sources https://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-42018---anonymous-user-token-generation-exposure
https://nvd.nist.gov/vuln/detail/CVE-2026-42018
https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018
https://www.servnetuk.com/news/jfrog-artifactory-exploit-2026

Hunting hypothesis agent

Hunt Artifactory access logs for unauthenticated POST /access/api/v1/aws/token/ returning HTTP 200 with a JWT, followed by POST /access/api/v1/tokens from the same source IP; a 401 then 200 on the same path signals variant probing.

Research details

Component/access/api/v1/aws/token/ endpoint (anonymous-user token generation)
PreconditionsNetwork access to Artifactory's /access/api/v1/ endpoint on a self-hosted instance running a vulnerable version (< 7.111.20, 7.117.0–7.117.27, 7.125.0–7.125.19, 7.133.0–7.133.28, or 7.146.0–7.146.8); anonymous access does not need to be enabled — the flaw returns the token even when it is disabled; no authentication required agent
DeliveryNetwork (HTTP POST)
Public PoCno
Advisoryhttps://docs.jfrog.com/releases/docs/jfrog-security-advisories#cve-2026-42018---anonymous-user-token-generation-exposure
Exploit notesCVSS attack complexity: LOW — unauthenticated, single POST request; actively exploited in the wild chained with CVE-2026-42016 to escalate from anonymous token to admin; Wiz observed exploitation 15 Aug–8 Sep 2026 across multiple actors; no public weaponized PoC but Wiz blog details the exact request sequence (POST /access/api/v1/aws/token/ returning anonymous JWT, then POST /access/api/v1/tokens for admin scope)
SummaryJFrog Artifactory exposes an internal anonymous-user JWT via its AWS token endpoint to unauthenticated callers even when anonymous access is disabled. Attackers chain this token leak with CVE-2026-42016 to escalate to admin scope, then create persistent accounts, deploy malicious Groovy plugins for code execution, and install Rust-based backdoors for persistence. Wiz observed active exploitation from mid-August through early September 2026 across multiple threat actors. Upgrade to a patched version on each affected branch to remediate.

Tia coverage

First reported2026-09-01
First exploit report2026-09-11
Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-4-known-exploited-vulnerabilities-to-catalog-septembercisa-kev-update-five-actively-exploited-artifactory-screenconnecjfrog-artifactory-vulnerabilities-actively-exploited-in-the-wild

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub