Vulnerabilities

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller…

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Sonatype / JFrog

Product

Java libraries / app servers, Nexus Repository / Artifactory

CVSS

7.5

CISA KEV

listed

Exploitation

observed in the wild

Fix

available

Exposure class

Web platform, Developer platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-42018 on this site · NVD · CVE.org · Vulnpedia · KEV

Other items that share a CVE or were clustered with this one.

1. 31
   Research Insikt Group 19d ago

   September 2026 CVE Landscape

   EPSS 1.00 CVE-2026-88771CVE-2026-88772CVE-2026-35273+57 more
2. 59
   CISA alert CISA 11 Sep 2026

   CISA Adds Three Known Exploited Vulnerabilities to Catalog

   Exploited CVE-2026-42016CVE-2026-42018CVE-2026-84869 ConnectWise Sonatype / JFrog
3. 44
   Wiz Research Wiz 10 Sep 2026

   Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329

   Exploited CVE-2026-42016CVE-2026-42018CVE-2026-82329+1 more Sonatype / JFrog
4. 68
   KEV NVD 28 Aug 2026

   JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with…

   KEV CVSS 9.8 Fix available CVE-2026-82329 Sonatype / JFrog