CISA added CVE-2026-42016 and CVE-2026-42018 to the Known Exploited Vulnerabilities catalog on September 11 with a September 25 deadline — and on the 7.133 branch, the release that fixes the first one still leaves the second exploitable.
What happened
On September 11, 2026, two JFrog Artifactory vulnerabilities entered the Known Exploited Vulnerabilities catalog. NVD’s republication of CISA’s data gives both records a cisaExploitAdd of 2026-09-11 and a cisaActionDue of 2026-09-25. That is a 14-day clock.
The two are:
- CVE-2026-42016, which CISA names “JFrog Artifactory Incorrect Authorization Vulnerability.” The CVE record, published July 27, 2026, says “JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.” It is classed CWE-863. NVD scores it 8.8 high as primary; JFrog, scoring its own record as a secondary source, gives 8.1. The two vectors differ on one metric — NVD marks availability impact high, JFrog marks it none.
- CVE-2026-42018, which CISA names “JFrog Artifactory Improper Authentication Vulnerability.” Published August 12, 2026, it describes Artifactory returning “an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.” It is classed CWE-287 and carries a 7.5 high from JFrog. NVD lists no primary score of its own.
Both records carry the standard BOD 26-04 required action, which on CVE-2026-42018 reads, verbatim: “Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.”
One thing we could not settle. CISA’s alert for the day is titled “CISA Adds One Known Exploited Vulnerability to Catalog,” and that title came back consistently across searches — but two records carry an exploit-add date of September 11, and both were confirmed individually against NVD. cisa.gov returns 403 to automated fetching, so the alert page itself could not be read to reconcile the count. Either the alert undercounts the day’s additions, or one of these two was cataloged outside the alert. The NVD records are the primary evidence, and they say two.
The same-branch fix gap
This is the part that will catch people, and it is visible only if you read both records together.
JFrog’s advisory fixes CVE-2026-42016 in 7.133.11, stated as a single version. It fixes CVE-2026-42018 across five separate branch releases: 7.111.20, 7.117.27, 7.125.19, 7.133.28, and 7.146.8. NVD’s affected ranges for CVE-2026-42018 match that shape, including “7.133.0 to before 7.133.28.”
So on the 7.133 branch the two fixes are seventeen patch releases apart. An administrator who upgraded to 7.133.11 when CVE-2026-42016 was published in July closed that flaw and is still exposed to CVE-2026-42018 today. Both now sit under one catalog deadline of September 25, and a version check that stops at “are we past 7.133.11?” will report the box clean.
That matters more than a version-number curiosity because, according to the research below, the two are used together. CVE-2026-42018 hands an unauthenticated caller an anonymous token; CVE-2026-42016 exchanges that token for an administrator-scoped one. Neither alone produces admin. Patching the escalation half and leaving the token-disclosure half is the configuration that breaks the chain — which is genuine mitigation — but it is not what the catalog asks for, and it is not what a September 25 compliance check will be measured against.
Neither vendor advisory mentions exploitation
JFrog’s security advisory page lists CVE-2026-42016 as published and updated July 27, 2026, and CVE-2026-42018 as published August 12 and updated August 13, 2026. Both are rated High. Neither carries a statement that the flaw has been exploited.
The exploitation account comes from elsewhere. Wiz Research published on September 10, 2026 that it “identified active, in-the-wild exploitation” of three Artifactory flaws — these two plus CVE-2026-82329 — with attacks observed from August 15 through September 8, 2026. Wiz describes the chain in request terms: an unauthenticated POST /access/api/v1/aws/token/ retrieves the anonymous token, and that JWT is then exchanged at POST /access/api/v1/tokens for an admin-scoped token. Post-exploitation, Wiz reports persistent administrator account creation, malicious Groovy plugins deployed through Artifactory’s own plugin framework, Rust-based backdoors, webshell uploads, and credential theft.
On scale, Wiz’s figures are prevalence, not host counts: it reports that 67% of organizations running JFrog Artifactory had at least one instance vulnerable to CVE-2026-42016, and 69% for CVE-2026-42018, as measured at publication. That is one vendor’s view of its own customer base, it counts organizations rather than servers, and no count of compromised instances has been published by anyone. Wiz names no threat actor and describes “multiple actors.”
Why it matters
This is the third and fourth JFrog Artifactory vulnerability to enter the catalog in sixteen days. CVE-2026-66384 was added August 27 with a September 10 due date. CVE-2026-82329, a 9.8 that grants unauthenticated administrative access under default configuration, was added September 2 with a September 5 due date. Severity Daily covered all three.
Four catalog entries against one product inside two weeks is a signal about the product’s position rather than about any single bug. Artifactory is a binary repository: it sits between a build system and everything that build system ships, holding credentials for downstream registries and serving artifacts that are trusted by definition. An attacker with an admin token there does not need to find another vulnerability to reach production. The Groovy-plugin persistence Wiz describes is the clearest expression of that — the compromise lives inside the artifact pipeline’s own extension mechanism.
The second thing worth noticing is the spread of the deadlines. Four entries against one product drew three different clocks: 14 days for CVE-2026-66384, three days for CVE-2026-82329, and 14 days for today’s pair. Under BOD 26-04 those bands are derived from four binary variables — internet exposure, KEV listing, exploit automation, and total versus partial technical impact — and the directive publishes four bands: three days, 14 days, 60 days, and a deferral tier. What it does not publish in readable form is the mapping. That schedule appears only as PNG images in Appendix A with no alt text, and the public transcriptions of it disagree with each other about which combinations earn three days. So we cannot tell you why a chain under documented attack since August 15 drew 14 days while CVE-2026-82329 drew three, and neither can anyone else working from the published directive. That is worth saying plainly rather than guessing at.
The third is the catalog’s naming. CVE-2026-42018 and CVE-2026-82329 are listed under the identical cisaVulnerabilityName, “JFrog Artifactory Improper Authentication Vulnerability,” though they are different flaws with different fixes and different deadlines. Anyone matching catalog entries to tickets by name rather than by CVE ID will collapse two obligations into one.
What to do
Upgrade to a release that fixes both, on your branch. For CVE-2026-42018 the fixed versions are 7.111.20, 7.117.27, 7.125.19, 7.133.28, and 7.146.8; CVE-2026-42016 is fixed at 7.133.11. Because the CVE-2026-42018 fixes are later on every branch that carries both, upgrading to the CVE-2026-42018 version for your branch closes both. Do not stop at 7.133.11.
Check whether you are already past the first fix but short of the second. The population most at risk here is the one that patched promptly in July or August: 7.133.11 through 7.133.27 is fixed for the escalation and open for the token disclosure.
Then hunt, because exploitation predates the catalog entry by nearly a month. Wiz’s indicators include administrator accounts matching the patterns svc_[a-zA-Z0-9]{8} and 0xTerror, a callback to log.gitclone[.]org on port 45678, and the SHA-1 513a907b69edffc3cb77a494da395178d21ef9bd. Review the Groovy plugins directory for anything you did not put there, audit administrator accounts and access tokens created since August 15, and rotate any credential Artifactory holds for downstream registries — an admin token on this box reaches them.
Federal civilian agencies: the due date on both entries is September 25, 2026, and the required-action text points at BOD 26-04’s forensic triage requirements alongside remediation.
Sourcing note
KEV dates for CVE-2026-42016 and CVE-2026-42018 were read from NVD’s API record for each CVE, which republishes CISA’s own cisaExploitAdd, cisaActionDue, cisaVulnerabilityName, and cisaRequiredAction fields. Both were confirmed one record at a time; both show lastModified values of September 11, 2026 and a status of “Analyzed.” cisa.gov returns 403 to automated fetching, so CISA’s own alert page was not read. Its title, “CISA Adds One Known Exploited Vulnerability to Catalog,” dated September 11, 2026, came from search results only, and it conflicts with the two records NVD carries for that date. That conflict is unresolved and is reported here rather than smoothed over. The dates for CVE-2026-66384 and CVE-2026-82329 were confirmed the same way, per record, in NVD.
Fixed versions, severities, and advisory dates are from JFrog’s own security advisories page, read directly. CVSS scores and vectors, CWE classes, descriptions, and affected version ranges are NVD’s, with the scoring source identified where NVD and JFrog differ.
The exploitation account is single-vendor research: Wiz Research, published September 10, 2026. Its prevalence figures are percentages of organizations running Artifactory within Wiz’s own visibility, not counts of servers and not counts of compromised systems. No attribution to a named actor is asserted by Wiz or here.
Unresolved: whether CISA’s alert count of one is an error or whether one of these two records was cataloged outside that alert; why two flaws chained in documented attacks drew a 14-day band while a related Artifactory flaw drew three days, which cannot be determined because the BOD 26-04 tier schedule is published only as images; and how many Artifactory instances have actually been compromised, which nobody has published.