Anonymous user token generation exposure in JFrog Artifactory

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

1. 2026-08-12 Published
2. 2026-09-11 Added to CISA KEV
3. 2026-09-25 CISA patch deadline
4. 2026-10-01 CISA SSVC: exploitation active

Added

59 d ago (2026-09-11)

Patch by

2026-09-25 (45 d ago)

Ransomware

Not known

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor, product

JFrog, Artifactory

CISA name

JFrog Artifactory Improper Authentication Vulnerability

Exploitation

Active, exploited in the wild

Automatable

yes

Technical impact

partial

Assessed

38 d ago (2026-10-01)

9.98% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Nuclei template JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass nuclei detection template

• jfrog artifactory

Weakness

• CWE-287 Improper Authentication

• docs.jfrog.com /releases/docs/jfrog-security-advisories

  vendor-advisory

• docs.jfrog.com /releases/docs/artifactory-self-managed-releases

  vendor-advisory, release-notes

• wiz.io /blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201

  third-party-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018

  government-resource, us-government-resource

• CVE List CVE-2026-42018
• NVD CVE-2026-42018

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.