CVE-2026-42018 CISA KEV · Actively exploitedSuited to automated attack · CISA
Anonymous user token generation exposure in JFrog Artifactory
CVSS score
7.5
EPSS probability
%9.8
Risk score
1.5
Published
2 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
JFrog Artifactory 预认证全链 RCE 复现项目（CVE-2026-42018 / CVE-2026-65616 / CVE-2026-65615）：完整攻击链报告、7.146.7 Docker 复现交付物（EXP / 部署 / 基线验证 / payload 样本 / 恢复工具）
Makefile Go / Python
Nuclei: JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass
Makefile Go / Python
Similar Vulnerabilities
9.8
CVE-2026-82329 Actively exploited
Potential authentication bypass leading to administrative access in Artifactory
J
Patch status unknown Public Exploits:6EPSS %14
8.1
CVE-2026-42016 Actively exploited
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
J
WorkaroundEPSS %9
8.1
CVE-2024-34394
libxmljs2 namespaces type confusion RCE
J
Patch status unknownEPSS %1
8.1
CVE-2024-34393
libxmljs2 attrs type confusion RCE
J
Patch status unknownEPSS %1
5.3
CVE-2026-66384 Actively exploited
Authenticated users may write data outside the intended Docker cache path
J
Patch status unknownEPSS %1
8.8
CVE-2026-65617
Deserialization of untrusted data in Jfrog Artifactory
J
Patch status unknownEPSS %1
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-42018"