CVE-2026-42018HighKEV

CVE-2026-42018

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

TCL Priority

CVSS

7.5

EPSS

KEV

Yes

Exploitation

reported

Timeline

CVE Published
80d ago · NVD
Added to TCL Advisory
50d ago · TCL Advisory
Added to CISA KEV
50d ago · CISA
Exploitation Status Changed
50d ago · TCL Advisory

What Changed?

Exploitationunknown→reportedcisa_kev

KEVNO→YEScisa_kev

Sources

NVD · Updated 50d ago

CISA KEV · Updated 51d ago

References

reefs@jfrog.com reefs@jfrog.com 134c704f-9b21-4f2e-91b3-4a467353bcc0 134c704f-9b21-4f2e-91b3-4a467353bcc0