CVE-2026-42018 Jfrog Artifactory
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
- CVSS
- 7.5 High
- EPSS
- 10.0%
- Percentile
- 96
- Published
- 2026-08-12
- Force
- 9 of 12
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
On CISA’s exploited list
JFrog Artifactory Improper Authentication Vulnerability
- Added
- 2026-09-11
- Federal patch deadline
- 2026-09-25
- Ransomware use
- not known