Known exploited vulnerabilities
JFrog vulnerabilities attackers have used
Every JFrog vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.
The short answer
CISA lists 4 JFrog vulnerabilities as exploited in the wild, 4 of them added in the last 12 months. The most recent is CVE-2026-42018, added Sep 11, 2026. Artifactory has the most entries (4).
- In KEV, all time
- 4
- Added, last 12 months
- 4
- Used in ransomware
- 0
- New CVEs this week
- 0
Every JFrog entry in CISA KEV
CVE-2026-42018
Added · dueJFrog Artifactory Improper Authentication Vulnerability
JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CVE-2026-42016
Added · dueJFrog Artifactory Incorrect Authorization Vulnerability
JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
CVE-2026-82329
Added · dueJFrog Artifactory Improper Authentication Vulnerability
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.
CVE-2026-66384
Added · dueJFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.
Related
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.