Artifactory anonymous token chain (CISA KEV)
Direct answer
Artifactory anonymous token chain (CISA KEV), also tracked as CVE-2026-42018 / Artifactory anonymous token exposure / CVE-2026-42016 is a critical-severity threat campaign HOL Guard tracked from Sep 11, 2026 to Sep 11, 2026, verified against 4 primary sources and last reviewed Sep 20, 2026. Active tracking has ended and the record remains published as a permanent historical research record.
Self-hosted JFrog Artifactory could hand an internal anonymous-user token to an unauthenticated caller even when anonymous access was disabled, opening a path into sensitive resources. CISA KEV and public in-the-wild reporting apply. Upgrade past the fixed builds for your Artifactory train and rotate credentials if exposure is plausible.
Also tracked as CVE-2026-42018 · Artifactory anonymous token exposure · CVE-2026-42016
- First observed
- Sep 11, 2026
- Last observed
- Sep 11, 2026
- Last reviewed
- Sep 20, 2026
- Tracking ended
- Sep 11, 2026
Record exports
Uncertainty and limitations
Read the evidence limits before acting on this record.
Sibling CVE-2026-42016 may appear in the same advisory wave; confirm both IDs and exact fixed builds against JFrog's advisory for your installed build.
- Covers the anonymous token / scope chain tracked under CVE-2026-42018 (and related CVE-2026-42016 context); not every Artifactory CVE.
- CISA KEV and public in-the-wild reporting elevate urgency; rotate tokens after upgrade if exposure is suspected.
- Fixed version list must be verified against JFrog's live advisory for your minor.
Guard coverage and policy
What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.
No Guard coverage mapping or campaign-specific policy guidance is published for this record.
Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
Timeline
Reviewed events, oldest first, each tied to a verified source.
- Disclosure
CVE-2026-42018 Artifactory anonymous token exposure disclosed / KEV-tracked.
Sources:CISA KEV catalog entry·Wiz in-the-wild Artifactory exploitation write-up·NVD CVE-2026-42018
- Update
HOL Guard published operator coverage of the Artifactory anonymous token KEV chain.
Source:HOL Guard operator write-up
Publication clock: 234.9 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.
Reviewed artifacts
The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.
JFrog Artifactory@>=0 <7.146.8 (see train-specific floors)jfrogpackage
Sources
Every claim on this record is traceable to the sources below.
Campaign questions, answered
Self-hosted JFrog Artifactory could hand an internal anonymous-user token to an unauthenticated caller even when anonymous access was disabled, opening a path into sensitive resources. CISA KEV and public in-the-wild reporting apply. HOL Guard tracked the campaign from Sep 11, 2026 to Sep 11, 2026.
No. Active tracking ended Sep 11, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.
The record cites 4 primary sources, names 1 reviewed artifact, and was last fully reviewed Sep 20, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.
Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Sibling CVE-2026-42016 may appear in the same advisory wave; confirm both IDs and exact fixed builds against JFrog's advisory for your installed build.
Reviewed in full by HOL Guard Security Publishing.
- Published
- Last full review
- Last modified
Record HGTC-2026-9A0FBC5F