CVE-2026-42018

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Oct 23, 2026

Description

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
jfrog	artifactory	< 7.111.20; >= 7.117.0, < 7.117.27; >= 7.125.0, < 7.125.19; >= 7.133.0, < 7.133.28; >= 7.146.0, < 7.146.8

References

https://docs.jfrog.com/releases/docs/artifactory-self-managed-releasesRelease Notes
https://docs.jfrog.com/releases/docs/jfrog-security-advisoriesVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018US Government Resource
https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201Third Party Advisory

Timeline

Published: Aug 12, 2026
Last modified: Oct 23, 2026
Added to CISA KEV: Sep 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-420199.1Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-G CVE-2026-42024.3The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records whe CVE-2026-420209.1Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-G CVE-2026-420219.1Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X CVE-2026-420229.1Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X CVE-2026-420239.1Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X CVE-2026-420249.1Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X CVE-2026-420259.1Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s)CVE-2026-420269.1Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s)CVE-2026-420279.8Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, befor CVE-2026-420285.3novaGallery is a php image gallery. Prior to version 2.1.1, a path traversal vulnerability has been identified in novaGallery. This allows u CVE-2026-42039.8A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-3