{"data":{"id":"3f76128f-b1d8-453d-bed0-6564dc2ef7b0","title":"CVE-2026-42018: JFrog Artifactory Improper Authentication Vulnerability","summary":"JFrog Artifactory has an improper authentication vulnerability (a flaw in how the software verifies user identity) that could accidentally give an internal anonymous-user token (a credential that grants access without logging in) to someone who shouldn't have access, especially when anonymous access is supposed to be turned off. This could expose sensitive files and data stored in Artifactory. This vulnerability is currently being exploited by attackers in real attacks.","solution":"Apply mitigations according to JFrog vendor instructions at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases, following CISA's BOD 26-04 guidance for prioritizing security updates. If mitigations are unavailable, discontinue use of the product for cloud services per BOD 26-04 requirements. Due date for patching is 2026-09-25.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42018","publishedAt":"2026-09-11T00:00:00.000Z","cveId":"CVE-2026-42018","cweIds":["CWE-287"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["JFrog Artifactory"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"active","epssScore":0.00349,"patchAvailable":true,"disclosureDate":"2026-09-11T00:00:00.000Z","capecIds":["CAPEC-114"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.72,"researchCategory":null,"atlasIds":null}}