CVE-2026-42018KEV · OVERDUECWE-287

JFrog Artifactory Improper Authentication Vulnerability

High · published August 12, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 95.5th percentile for exploit probability.

28
days past CISA
deadline
CVSS v3.1
7.5
EPSS
10%
Percentile
95.5
In the wild
Confirmed
What it is

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.09805 · 95.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-08-12T22:17Z
KEV added
2026-09-11 · due 2026-09-25
Affected products (5)
ProductVersionsFixed in
jfrog/artifactory< 7.111.207.111.20
jfrog/artifactory≥ 7.117.0, < 7.117.277.117.27
jfrog/artifactory≥ 7.125.0, < 7.125.197.125.19
jfrog/artifactory≥ 7.133.0, < 7.133.287.133.28
jfrog/artifactory≥ 7.146.0, < 7.146.87.146.8
References (4)
https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases · [email protected]https://docs.jfrog.com/releases/docs/jfrog-security-advisories · [email protected]https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 21 SEP 03:34Z
    EPSS moved 1% → 11%
    epss
  • 20 SEP 03:23Z
    EPSS moved 1% → 11%
    epss
  • 12 AUG 17:43Z
    Anonymous user token generation exposure in JFrog Artifactory
    cvelistv5