CVE-2026-42018: listed in the CISA KEV catalog

CVE-2026-42018 · CVSS 7.5 HIGH · KEV 2026-09-11 · patch available

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Is CVE-2026-42018 exploited?

• Listed in the CISA KEV catalog on 2026-09-11.
• Federal remediation due 2026-09-25.
• Public exploit code: none found in monitored sources.
• Public detection rules exist.

Which products and versions are affected?

• JFrog · Artifactory · SaaS <7.164.0
• JFrog · Artifactory · Self-Managed <7.161.16

Is there a patch?

• Artifactory SaaS 7.164.0
• Artifactory Self-Managed 7.161.16

What PlainSec published about CVE-2026-42018

• Wiz Finds Artifactory Admin Takeover in the Wild (2026-09-17)
• Artifactory Chaining Gave Attackers Admin Backdoors (2026-09-09)

Primary sources

• NVD record
• CISA KEV catalog
• Nuclei template

What this record does not say

• No EPSS score.

KEV and EPSS are re-checked daily. Record last updated 2026-09-18.