CVE-2026-42018: listed in the CISA KEV catalog CVE-2026-42018 · CVSS 7.5 HIGH · KEV 2026-09-11 · patch available
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Is CVE-2026-42018 exploited? Listed in the CISA KEV catalog on 2026-09-11. Federal remediation due 2026-09-25. Past that date by 49 days. Public exploit code: none found in monitored sources. Public detection rules exist. Which products and versions are affected? jfrog · artifactory · >= 0, < 7.111.20, >= 7.117.0, < 7.117.27, >= 7.125.0, < 7.125.19, >= 7.133.0, < 7.133.28, >= 7.146.0, < 7.146.8 Is there a patch? Yes. Update to one of these or later:
artifactory 7.111.20 artifactory 7.117.0 7.117.27 artifactory 7.125.0 7.125.19 artifactory 7.133.0 7.133.28 artifactory 7.146.0 7.146.8
From jfrog's CVE record · jfrog advisory
What PlainSec published about CVE-2026-42018 Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-09-18.
CVE-2026-42018: listed in the CISA KEV catalog CVE-2026-42018 · CVSS 7.5 HIGH · KEV 2026-09-11 · patch available
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
Is CVE-2026-42018 exploited? Listed in the CISA KEV catalog on 2026-09-11. Federal remediation due 2026-09-25. Past that date by 49 days. Public exploit code: none found in monitored sources. Public detection rules exist. Which products and versions are affected? jfrog · artifactory · >= 0, < 7.111.20, >= 7.117.0, < 7.117.27, >= 7.125.0, < 7.125.19, >= 7.133.0, < 7.133.28, >= 7.146.0, < 7.146.8 Is there a patch? Yes. Update to one of these or later:
artifactory 7.111.20 artifactory 7.117.0 7.117.27 artifactory 7.125.0 7.125.19 artifactory 7.133.0 7.133.28 artifactory 7.146.0 7.146.8
From jfrog's CVE record · jfrog advisory
What PlainSec published about CVE-2026-42018 Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-09-18.