Severity Daily

IT and AI security incidents, checked against the primary source

Tag: CVE-2026-42018

  • In three of today’s eight stories, the fix on offer covers less than the flaw does

    In three of today’s eight stories, the fix on offer covers less than the flaw does

    The most consequential thing on the site today is not the 10.0. It is a three-day federal clock that runs out on Sunday. CISA added two of the three exploited MikroTik RouterOS flaws to the Known Exploited Vulnerabilities catalog on September 10, due September 13, and left off the SSH authentication bypass that CERT Polska puts first in the chain. Exploitation is confirmed by a national CERT, all three flaws are closed by the same RouterOS releases, and Shadowserver counts at least 122,500 MikroTik devices with SSH reachable per 24-hour scan window. An agency that upgrades is fine. An agency that works the catalog as a queue — patch what is listed, ticket what carries a due date — finishes Sunday compliant and still reachable through the door the catalog does not name.

    The biggest-sounding story is GitLab’s, and it ranks second. An unauthenticated arbitrary file read in the repository commits API, scored 10.0, is as bad as a number gets, and the research published on September 11 describes reaching configuration files, credentials, tokens, and SSH keys. But nobody has confirmed exploitation — watchTowr reports probes, and probing is not exploitation — and the 10.0 is GitLab’s own, with NVD returning no record at all as of early this morning. Recompute the vector without the integrity impact the advisory’s own description does not describe, and it is an 8.6. What is not in dispute is the work: self-managed operators have a critical to install, and some of them cannot.

    That last clause is the day’s thread, and it runs through three of the eight stories. GitLab names installations from 18.7 as affected and ships no 18.x build in the release, so a shop sitting on 18.7 through 18.11 is inside the affected range and outside the branch that got the fix — a major-version migration, not a patch. CISA put two more JFrog Artifactory flaws on KEV with a September 25 deadline, and on the 7.133 branch their fixes are seventeen patch releases apart: an administrator who took 7.133.11 in July to close CVE-2026-42016 is still exposed to CVE-2026-42018 today, and a version check that stops at 7.133.11 reports the box clean. And CISA’s MikroTik entries cover two links of a three-link chain. In each case the fix on offer covers less than the flaw does, and in each case you see it only by reading two documents side by side.

    The other four are disclosure stories, and what they share is an absence. Florida’s motor vehicle agency confirmed that DAVID, its law enforcement driver database, was breached through credentials a Plant City police employee stored on a personal device, and named no number; every figure in circulation — 200,000 records, Social Security numbers, and dates of birth — belongs to ShinyHunters. Nutex Health’s stolen data has been published online, and the company filed that under Item 8.01 with its materiality assessment unchanged, no count and no dates. Conduent settled the class action over its January 2025 breach with no dollar figure, also under Item 8.01, having filed the incident itself under Item 1.05. Greenberg Traurig told Vermont and California regulators that Social Security numbers were in scope on September 8 and September 9, then publicly called the exposure limited on September 10. Furthest from an action item, Anthropic’s misuse report describes one actor working through roughly thirty AI companies in about four days, swapping in each victim’s own API keys as it went — a billing and attribution problem as much as a security one.

    Open tonight. CVE-2026-67276, the MikroTik bypass, still carries no exploit-add date and may yet be added; worth re-checking before Sunday. CISA’s alert for September 11 is titled as one catalog addition while two records carry that day’s exploit-add date, and cisa.gov returns 403 to automated fetching, so the count could not be reconciled. GitLab has said nothing about the 18.x case. The distillation claim circulating in coverage of the Anthropic report — seven named Chinese labs, industrial scale — does not appear in the document we read. And four organizations described a breach today without producing a number. Nutex says its review will take several weeks.

  • CISA puts two more JFrog Artifactory flaws on KEV with a September 25 deadline, and the release that fixes one still leaves the other open on the same branch

    CISA puts two more JFrog Artifactory flaws on KEV with a September 25 deadline, and the release that fixes one still leaves the other open on the same branch

    CISA added CVE-2026-42016 and CVE-2026-42018 to the Known Exploited Vulnerabilities catalog on September 11 with a September 25 deadline — and on the 7.133 branch, the release that fixes the first one still leaves the second exploitable.

    What happened

    On September 11, 2026, two JFrog Artifactory vulnerabilities entered the Known Exploited Vulnerabilities catalog. NVD’s republication of CISA’s data gives both records a cisaExploitAdd of 2026-09-11 and a cisaActionDue of 2026-09-25. That is a 14-day clock.

    The two are:

    • CVE-2026-42016, which CISA names “JFrog Artifactory Incorrect Authorization Vulnerability.” The CVE record, published July 27, 2026, says “JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.” It is classed CWE-863. NVD scores it 8.8 high as primary; JFrog, scoring its own record as a secondary source, gives 8.1. The two vectors differ on one metric — NVD marks availability impact high, JFrog marks it none.
    • CVE-2026-42018, which CISA names “JFrog Artifactory Improper Authentication Vulnerability.” Published August 12, 2026, it describes Artifactory returning “an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.” It is classed CWE-287 and carries a 7.5 high from JFrog. NVD lists no primary score of its own.

    Both records carry the standard BOD 26-04 required action, which on CVE-2026-42018 reads, verbatim: “Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.”

    One thing we could not settle. CISA’s alert for the day is titled “CISA Adds One Known Exploited Vulnerability to Catalog,” and that title came back consistently across searches — but two records carry an exploit-add date of September 11, and both were confirmed individually against NVD. cisa.gov returns 403 to automated fetching, so the alert page itself could not be read to reconcile the count. Either the alert undercounts the day’s additions, or one of these two was cataloged outside the alert. The NVD records are the primary evidence, and they say two.

    The same-branch fix gap

    This is the part that will catch people, and it is visible only if you read both records together.

    JFrog’s advisory fixes CVE-2026-42016 in 7.133.11, stated as a single version. It fixes CVE-2026-42018 across five separate branch releases: 7.111.20, 7.117.27, 7.125.19, 7.133.28, and 7.146.8. NVD’s affected ranges for CVE-2026-42018 match that shape, including “7.133.0 to before 7.133.28.”

    So on the 7.133 branch the two fixes are seventeen patch releases apart. An administrator who upgraded to 7.133.11 when CVE-2026-42016 was published in July closed that flaw and is still exposed to CVE-2026-42018 today. Both now sit under one catalog deadline of September 25, and a version check that stops at “are we past 7.133.11?” will report the box clean.

    That matters more than a version-number curiosity because, according to the research below, the two are used together. CVE-2026-42018 hands an unauthenticated caller an anonymous token; CVE-2026-42016 exchanges that token for an administrator-scoped one. Neither alone produces admin. Patching the escalation half and leaving the token-disclosure half is the configuration that breaks the chain — which is genuine mitigation — but it is not what the catalog asks for, and it is not what a September 25 compliance check will be measured against.

    Neither vendor advisory mentions exploitation

    JFrog’s security advisory page lists CVE-2026-42016 as published and updated July 27, 2026, and CVE-2026-42018 as published August 12 and updated August 13, 2026. Both are rated High. Neither carries a statement that the flaw has been exploited.

    The exploitation account comes from elsewhere. Wiz Research published on September 10, 2026 that it “identified active, in-the-wild exploitation” of three Artifactory flaws — these two plus CVE-2026-82329 — with attacks observed from August 15 through September 8, 2026. Wiz describes the chain in request terms: an unauthenticated POST /access/api/v1/aws/token/ retrieves the anonymous token, and that JWT is then exchanged at POST /access/api/v1/tokens for an admin-scoped token. Post-exploitation, Wiz reports persistent administrator account creation, malicious Groovy plugins deployed through Artifactory’s own plugin framework, Rust-based backdoors, webshell uploads, and credential theft.

    On scale, Wiz’s figures are prevalence, not host counts: it reports that 67% of organizations running JFrog Artifactory had at least one instance vulnerable to CVE-2026-42016, and 69% for CVE-2026-42018, as measured at publication. That is one vendor’s view of its own customer base, it counts organizations rather than servers, and no count of compromised instances has been published by anyone. Wiz names no threat actor and describes “multiple actors.”

    Why it matters

    This is the third and fourth JFrog Artifactory vulnerability to enter the catalog in sixteen days. CVE-2026-66384 was added August 27 with a September 10 due date. CVE-2026-82329, a 9.8 that grants unauthenticated administrative access under default configuration, was added September 2 with a September 5 due date. Severity Daily covered all three.

    Four catalog entries against one product inside two weeks is a signal about the product’s position rather than about any single bug. Artifactory is a binary repository: it sits between a build system and everything that build system ships, holding credentials for downstream registries and serving artifacts that are trusted by definition. An attacker with an admin token there does not need to find another vulnerability to reach production. The Groovy-plugin persistence Wiz describes is the clearest expression of that — the compromise lives inside the artifact pipeline’s own extension mechanism.

    The second thing worth noticing is the spread of the deadlines. Four entries against one product drew three different clocks: 14 days for CVE-2026-66384, three days for CVE-2026-82329, and 14 days for today’s pair. Under BOD 26-04 those bands are derived from four binary variables — internet exposure, KEV listing, exploit automation, and total versus partial technical impact — and the directive publishes four bands: three days, 14 days, 60 days, and a deferral tier. What it does not publish in readable form is the mapping. That schedule appears only as PNG images in Appendix A with no alt text, and the public transcriptions of it disagree with each other about which combinations earn three days. So we cannot tell you why a chain under documented attack since August 15 drew 14 days while CVE-2026-82329 drew three, and neither can anyone else working from the published directive. That is worth saying plainly rather than guessing at.

    The third is the catalog’s naming. CVE-2026-42018 and CVE-2026-82329 are listed under the identical cisaVulnerabilityName, “JFrog Artifactory Improper Authentication Vulnerability,” though they are different flaws with different fixes and different deadlines. Anyone matching catalog entries to tickets by name rather than by CVE ID will collapse two obligations into one.

    What to do

    Upgrade to a release that fixes both, on your branch. For CVE-2026-42018 the fixed versions are 7.111.20, 7.117.27, 7.125.19, 7.133.28, and 7.146.8; CVE-2026-42016 is fixed at 7.133.11. Because the CVE-2026-42018 fixes are later on every branch that carries both, upgrading to the CVE-2026-42018 version for your branch closes both. Do not stop at 7.133.11.

    Check whether you are already past the first fix but short of the second. The population most at risk here is the one that patched promptly in July or August: 7.133.11 through 7.133.27 is fixed for the escalation and open for the token disclosure.

    Then hunt, because exploitation predates the catalog entry by nearly a month. Wiz’s indicators include administrator accounts matching the patterns svc_[a-zA-Z0-9]{8} and 0xTerror, a callback to log.gitclone[.]org on port 45678, and the SHA-1 513a907b69edffc3cb77a494da395178d21ef9bd. Review the Groovy plugins directory for anything you did not put there, audit administrator accounts and access tokens created since August 15, and rotate any credential Artifactory holds for downstream registries — an admin token on this box reaches them.

    Federal civilian agencies: the due date on both entries is September 25, 2026, and the required-action text points at BOD 26-04’s forensic triage requirements alongside remediation.

    Sourcing note

    KEV dates for CVE-2026-42016 and CVE-2026-42018 were read from NVD’s API record for each CVE, which republishes CISA’s own cisaExploitAdd, cisaActionDue, cisaVulnerabilityName, and cisaRequiredAction fields. Both were confirmed one record at a time; both show lastModified values of September 11, 2026 and a status of “Analyzed.” cisa.gov returns 403 to automated fetching, so CISA’s own alert page was not read. Its title, “CISA Adds One Known Exploited Vulnerability to Catalog,” dated September 11, 2026, came from search results only, and it conflicts with the two records NVD carries for that date. That conflict is unresolved and is reported here rather than smoothed over. The dates for CVE-2026-66384 and CVE-2026-82329 were confirmed the same way, per record, in NVD.

    Fixed versions, severities, and advisory dates are from JFrog’s own security advisories page, read directly. CVSS scores and vectors, CWE classes, descriptions, and affected version ranges are NVD’s, with the scoring source identified where NVD and JFrog differ.

    The exploitation account is single-vendor research: Wiz Research, published September 10, 2026. Its prevalence figures are percentages of organizations running Artifactory within Wiz’s own visibility, not counts of servers and not counts of compromised systems. No attribution to a named actor is asserted by Wiz or here.

    Unresolved: whether CISA’s alert count of one is an error or whether one of these two records was cataloged outside that alert; why two flaws chained in documented attacks drew a 14-day band while a related Artifactory flaw drew three days, which cannot be determined because the BOD 26-04 tier schedule is published only as images; and how many Artifactory instances have actually been compromised, which nobody has published.